Online reviews in Spain: the 30-day rule nobody mentions

A client of ours who runs two clinics showed us his new testimonials page not long ago, rather pleased with it: fourteen five-star reviews, beautifully laid out, sitting right above the appointment form. We asked where they came from. "The ones people send us on WhatsApp — we put up the best ones." That perfectly innocent-sounding habit is exactly what Spanish law changed on 28 December.

So here's a short read on what actually changed about online reviews, what it obliges a small business to do today, and — the practical part — how it changes the moment you ask a customer for their opinion.

What changed, and since when

Ley 10/2025, of 26 December, Spain's customer-service law, has mostly been discussed for other reasons: fifteen working days to resolve a complaint, the right to be dealt with by an actual person. All of that is aimed at large companies and essential services, not at most small businesses.

But the law used its final provisions to rewrite article 20.4 of Spain's consolidated consumer act — the one that deals with reviews. That part applies to you whatever your size.

It has been in force since 28 December 2025, the day after publication. The twelve-month grace period you may have heard mentioned covers the customer-service obligations for the companies in scope; there is no grace period for the reviews part.

Three new things, and all three touch something you're probably already doing.

The thirty-day window changes when you ask

The first is the most concrete and the least reported: a review has to be about a product or service bought or used in the thirty calendar days before the date of the review.

Read that again with your own review requests in mind. The quarterly "how did we do?" email that goes out to your whole customer list no longer fits — half that list bought from you eight months ago. Neither does the January push to make up for last year's missing reviews. And that very service-industry habit of waiting until the client is properly happy — three months in, once results are showing — now falls outside the window.

What does fit is asking close to the service itself: same day, next day, that week at the latest. Which, as it happens, is what anyone who knows the subject would tell you for reasons that have nothing to do with the law. The memory is fresh, the customer knows what to say, and far more people reply than to a generic email months later.

If you currently ask for reviews by hand, whenever you remember, the fix is small: have the message go out by itself when the job, visit or order closes. That's the whole system.

You can reply, and you can ask for a fake one to be taken down

The second and third go together, and they're good news.

You can reply on the same channel. The article expressly recognises that the business whose product or service is reviewed is entitled to respond through the same channel. It sounds obvious — you could already do it on Google or Tripadvisor — but it's now a recognised right rather than a platform courtesy.

You can ask for a fake one to be removed. If a review wasn't written by someone who actually bought or used your service, or if it's misleading, you can request its removal. The small print matters: you have to prove it conclusively. "The name doesn't ring a bell" isn't enough. You need to be able to show that this person isn't in your calendar, your invoices or your message history.

This is where a tidy business wins and a messy one loses. If appointments live in a notebook and orders live on your partner's phone, proving that a given name never came through your workshop will cost you an afternoon. With even a minimal record of who came in and when, it's a five-minute email.

The disclosure almost no small-business website has

This is the part most widely ignored and least often checked.

If your site gives access to reviews — the embedded Google widget, the testimonial carousel, the "4.8 out of 5 from 312 reviews" in the header — you have to say whether or not you guarantee that those reviews were written by real customers, and explain clearly how you process them. And the burden of proof sits with you, not with whoever complains.

Failing to do it counts as a misleading unfair commercial practice. For a small business that rarely ends in a serious fine, but it is exactly the kind of thing an irritated competitor or an angry customer uses to drag you into a process that eats weeks.

The fix takes ten minutes: one honest line under the reviews block. If they're unfiltered Google reviews, say so. If they're testimonials you picked yourself, say that too, in those words. What you can't do is present your own selection as though it were the full picture of what people think.

And yes, that rules out what the clinic owner was doing. Picking the fourteen best WhatsApp messages and laying them out as "what our patients say" is precisely what the article asks you to clarify.

What not to do, however it's sold to you

Don't pay for reviews or trade them for a discount. Presenting reviews as genuine when they aren't was already an unfair practice before this reform. A discount in exchange for a review is a grey area that isn't worth it, and an incentive conditional on the review being positive is plainly out.

Don't build a filter in front. The trick of sending an internal survey first and only pointing the high scorers at Google has a name and a bad reputation. With the burden of proof on your side of the table, it's not a comfortable place to stand.

And don't overcorrect. If you have twenty honest reviews and no testimonials page, there's nothing here to fix: keep asking early and keep replying to all of them, bad ones included. The reform doesn't require you to build a system. It requires you not to lie about the one you already have.

What's coming: don't sit and wait for it

There's a lot of talk about the Digital Fairness Act. It's real, it's serious, and it sits in the Commission's 2026 work programme with a proposal expected in the last quarter of the year. But it's worth knowing what it is and isn't: it targets dark patterns, influencer marketing, addictive design and unfair personalisation. Reviews are not its main business, and the road from proposal to applicable law takes years.

In other words, the part that affects you has been in force since December. There's nothing to wait for.

The whole thing, short

Ask within thirty days of the service, with a message that goes out on its own. Reply to every review on the same channel. Keep a record of who your customers are, so you can knock down a fake one. And put an honest line under the reviews you display on your site.

All four are the kind of task you do well for three weeks and then forget. If that sounds familiar, this is exactly the sort of follow-up an operations agent can take over: the message goes out at the right moment, and you only review what deserves your time.