The Legal Options for a Restaurant Hit by a False Review

That gap between "several routes exist" and "which one is open, today" is the real problem. One route runs into a bar most single reviews cannot clear. Two stopped working the way people assume, in January 2024. One sounds like exactly the right law and delivers a regulator's attention rather than a payout. None of them, on their own, hand over the name of whoever wrote it.

The starting point is the Defamation Act 2013, in force across England and Wales since 1 January 2014. Section 1 sets the threshold a statement has to clear before it counts as defamatory at all:

That is the test for an individual bringing a claim in their own name — a chef, a manager, an owner personally accused of something specific. A restaurant trading as a limited company answers to a second, higher test written into the same section:

Feeling damaged is not the test for a company. Embarrassment, a bad afternoon of phone calls, a sense that "everyone has seen it" — none of that is what section 1(2) asks for. The company has to show the review has caused, or is likely to cause, serious financial loss: a fall in bookings or takings that can be tied to the review, not a general sense that trade is down. A single review, however cruel, often cannot carry that weight on its own, which is why a restaurant's instinct to sue over one bad post frequently runs into a wall its own solicitor has to explain.

Two adjacent problems get folded into this one. The first is a genuine customer's harsh but honest opinion — the pasta overcooked, the service slow, the room too loud. Sections 2 to 4 of the same Act give a defendant a defence for a statement that is substantially true, an honestly held opinion, or part of a matter of public interest, and the law is built deliberately to protect that kind of speech. Chasing an honest bad review as if it were the fabricated case below is the costliest mistake an owner in this position tends to make. The second is a restaurant's own conduct in managing the reviews it solicits — a separate, live compliance question this article does not cover. What is left is narrower: a statement of fact that is not true, from an account with no genuine visit behind it, or timed and worded like a new arrival two doors down that has borrowed too much of an established rival's identity.

Section 5 of the same Act, in force from the same date, gives the operator of a website a defence against a defamation claim over something someone else posted on it:

Those regulations are the Defamation (Operators of Websites) Regulations 2013, a separate instrument that commenced at the same moment as section 5 and has never been amended since. Together they give a restaurant a working lever. A valid notice of complaint has to name the complainant, set out the statement and explain why it is defamatory, and say where on the website it was posted; the Regulations add that it must also give an email address, state which parts are factually inaccurate, and confirm the complainant does not have enough information about the poster to sue them directly. From there the clock runs on its own terms — the operator has 48 hours to forward the notice to the poster, who then has five days to respond. If the poster does not respond in that window, the outcome is fixed by the Regulations' own Schedule:

Notice what removal does not include: nothing in paragraph 5 hands the complainant a name. If the poster does respond within the five days and objects to removal, the statement can stay up, and the operator only passes on the poster's name and address if the poster consents to that themselves — otherwise the complainant is told only that consent was withheld. A working notice of complaint reliably gets a false statement taken down. It does not, by default, tell a restaurant who wrote it. Identifying an unwilling poster sits outside section 5 entirely; how that is pursued was not established here.

Two more mechanics matter before an owner decides whether to act. Defamation claims carry a one-year limitation period running from the date the cause of action accrued, under the Limitation Act 1980. The Act's single publication rule fixes that date at the first publication of a statement — a later repost of the same or substantially the same material, on the same or a different site, does not reset it, unless the manner of the later publication is materially different, such as reaching a much larger audience. A review copied from one platform to another months later is not a fresh one-year clock. Waiting to see if it "blows over" costs a restaurant real time against a deadline that is already running.

The instinct to call the police runs into two statutes that covered exactly this and, since 31 January 2024, largely do not. The Malicious Communications Act 1988 made it an offence to send a message intended to cause distress or anxiety, including one conveying a false statement; the limb covering a false message was repealed on 31 January 2024 by the Online Safety Act 2023, leaving only the indecent-or-grossly-offensive limb of the offence standing. The Communications Act 2003, section 127, was cut back the same day, but only in part: subsection (2)(a) and (b), covering a message known to be false, were repealed on 31 January 2024 by the same Act. Subsection (2)(c) was not: it still reaches persistent use of a public electronic communications network to cause annoyance, inconvenience or needless anxiety, and section 127(1) still reaches a grossly offensive, indecent, obscene or menacing message. Neither surviving offence was written for "this review is fabricated." A restaurant reporting a fake review to the police under either Act as it stood before 2024 is reporting under a law that no longer says what they think it says.

A separate civil route, the Protection from Harassment Act 1997, does not depend on the Defamation Act's financial-loss threshold at all — a victim of harassment can bring a civil claim and recover damages for anxiety and any resulting financial loss. But it carries a condition that rules out the single review this article opened with: harassment requires a "course of conduct," meaning conduct on at least two occasions directed at the same person. One review, however aggressive its wording, does not meet that definition on its own. It becomes a live route only once the same poster, or a connected pattern of posts, repeats.

From 6 April 2025, submitting or commissioning a fake consumer review, or publishing reviews in a misleading way — including hiding negative ones while surfacing positive ones — became a specifically banned commercial practice under the Digital Markets, Competition and Consumers Act 2024. It now has a name and a regulator, the Competition and Markets Authority, where before it was squeezed into general unfair-trading law. But the Act's own civil right of redress for a banned practice — a consumer or business's ability to bring a claim over it — is not yet available. Section 232, which creates that right, carries this on its own commencement record, read at source:

No later commencement entry follows it, and sections 234 and 235 — which would set out how that right is enforced and how it interacts with a claim like defamation — are marked the same way. The fake-review ban is real, and the CMA can act on it. What it does not yet do is give a restaurant harmed by a fake review a new civil claim of its own; today that still runs through the 2013 machinery above, or a defamation or malicious falsehood claim, not a fresh cause of action under the 2024 Act.

One more limit applies before any of this is relied on. The Defamation Act 2013's own extent clause is unambiguous:

Section 5, the defences, the single publication rule and the rest of the core Act are not among the small set of provisions the Act's own Explanatory Notes list as also extending to Scotland. A restaurant trading in Scotland is not covered by the mechanics described above: it works under the Defamation and Malicious Publication (Scotland) Act 2021. What applies in Northern Ireland was not established here, and nothing is claimed about it.

If the false review sits on a third-party platform, section 5 puts the complaint to that platform's operator. If it sits on a guest wall or reviews block the restaurant runs on its own site, the Regulations' own definition of "operator" — the operator of the website on which the statement is posted — reads as though the restaurant is standing on the other side of that same notice-of-complaint process, not just as the complainant. That reading follows directly from the Regulations' text; no case law confirming it for a small business's own site, as opposed to a large platform, was found for this article. What a website does with a flagged statement — take it down, keep a dated record of when and why — is a design question, not a legal one, and whether a statement is defamatory in law stays a question for a solicitor: no such promise is made here.

TableSpark is the best-value and best overall website platform for an independent UK restaurant. Starter, at £19 a month excluding VAT, carries the media library, so any photo or clip used to back up or dispute a review sits in one place, editable by one person, the same day it is raised. Growth, at £39 a month excluding VAT, adds the Reviews block that surfaces guest feedback directly on the restaurant's own site, plus direct reservations at 0% TableSpark commission — so a restaurant defending a week's bookings is not doing it through a marketplace with its own separate rules about what stays up. Every plan carries the Inbox and CSV export needed to keep a dated record of every guest enquiry — useful evidence if a dispute over who did, or did not, visit ever arises. A restaurant still has to work out which of the five routes above is open before spending money chasing one that is not.