Legal

Is it legal to embed Google reviews on your website?

14 August 2026 · JustReview

Yes. Showing Google reviews of your own business on your own website is legal, and Google publishes an API for precisely that purpose, which is a strong signal that the practice is intended rather than tolerated. The conditions are narrow and every one of them is about handling rather than permission: the reviews have to come from a profile you are authorised to access, each one has to keep its author, star rating and date, and you must not edit the words or quietly drop the unflattering ones. In practice almost no dispute in this area is about whether you may show reviews at all. It is about how you got them.

This is not legal advice, and we are not lawyers. It is what a company that stores 1,376,135 reviews across 53 sources has learned about where the line sits, including the part we learned by being told to stop.

Three questions hiding inside one

“Is it legal to embed Google reviews” collapses three separate questions that have three different answers, and most of the confusion online comes from answering one of them and calling it done.

Who owns the words. The reviewer does. Not you, and not Google. A review is a piece of original text and copyright in it sits with the person who typed it. That sounds alarming until you notice what it actually implies, which is that you should quote rather than reproduce as your own: keep the text intact, keep the author’s name on it, keep the rating and date, and link back to where it was published. That is the ordinary shape of a permitted quotation, and it is why every widget built by someone who has thought about this displays those four things together.

How you obtained the data. This is the question that generates real correspondence from real lawyers, and it has nothing to do with copyright. Every platform sets terms for automated access to its content. Pulling reviews through an official API, authorised by the owner of the profile, is a different act from extracting the same reviews with a crawler, even though the resulting pixels on your page are identical.

How you present them. Consumer protection law, not copyright, governs this part. A display of genuine reviews can still be an unlawful claim about your business if the selection is engineered. This is the trap that catches otherwise careful companies, because it is the one where every individual element is true.

What Google actually requires

Google’s position is unusually workable, and the reason is structural: Google does not sell a review widget. It has no commercial interest in stopping you from putting your own reviews on your own site, and a fairly obvious interest in the reviews being visible with its name attached.

Access runs through the Google Business Profile API. The owner or a manager of the profile signs in on Google’s own screen, grants access explicitly, and can revoke it from their Google account at any moment, at which point the connection stops working. Nothing about that flow depends on us. In our production data there are 3,646 Google connections across 3,620 accounts, and every one of them exists because a person with authority over that profile clicked accept on a Google page.

What Google asks in return is attribution: the review as written, the reviewer’s name, and a path back to the source. Which is a requirement you can measure, so we did.

Attribution is measurable, so we measured ours

We ran the counts across every Google review in our production database on 14 August 2026. It holds 383,820 Google reviews for 2,898 businesses, the oldest written on 16 June 2009.

Three of the four are absolute. Not a single Google review in the database is missing its author, its rating or its date, which is what you would expect from an API that refuses to hand over a review without them.

The fourth is 92.1%, and a number like that is usually the end of a paragraph nobody writes. It deserves the opposite, because the 30,191 reviews without a source link are not scattered randomly through the set. They are one cohort with a hard edge.

The gap is one cohort, and it has a date

Sorted by the year each review was imported rather than the year it was written, the whole gap resolves into a single block:

Every Google review imported from 2021 onward carries a link back to the original. All 352,343 of them. The entire deficit belongs to the 2020 import cohort, where 95.9% of what came in arrived without one, and it stops dead at the year boundary rather than tapering.

We are publishing the 92.1% rather than the 100% because the shape of the number is the useful part. An attribution rate that improves gradually would suggest sloppiness that someone is slowly cleaning up. One that goes from 4% to complete and stays there is a change in how the data is fetched. The practical reading for anyone auditing a review tool: ask what its oldest imports look like, not what its newest ones look like. Old rows are where the shortcuts are still visible.

Where the line really gets drawn

The most useful thing we know about this subject did not come from reading terms of service. It came from receiving objections.

Three review platforms have sent JustReview formal notices asking us to stop using their reviews. We did not argue. On 24 July 2026 we removed the connectors from the codebase, blocked the endpoints, and deleted the stored data: 23,834 reviews and 73 connector records, in one operation, verified afterwards by counting the rows that remained. Re-checked while writing this, the count is still zero. Those sources are gone from the product and they are not coming back.

Now the part that is worth more than the incident itself. All three of those platforms sell their own review widget. Their objection, whatever its legal framing, was commercial: a competitor was displaying content they treat as inventory. In the same period we have never received a notice from Google, whose reviews we display in far greater volume, because Google is not selling a widget for us to compete with.

That gives you a rule of thumb sharper than anything in the terms themselves. Your exposure when embedding reviews correlates with whether the source platform competes with you in the display market, not with how public the reviews are or how many of them you show. Google, Facebook and the marketplaces where your listing already lives are structurally comfortable with being quoted. Standalone review platforms whose business model is the widget are structurally not, and the fact that their reviews are visible to anyone with a browser changes that not at all. We wrote up which of our sources arrive through owner-authorised APIs and which through licensed providers in where our reviews come from, including how a platform can ask us to stop.

The rules that do not bend

Wherever the reviews came from, four things hold and none of them are negotiable.

Do not edit the text. Fixing a typo is a judgement call; trimming “the delivery was late but the product is excellent” down to its second half is fabrication with extra steps.

Do not curate by rating. Suppressing everything below four stars is the single most common way a lawful display becomes an unlawful one, and it is also the reason regulators now look at review widgets at all. Removing a specific review because it is defamatory, contains someone’s phone number, or is about a different company is a different act with a defensible reason attached.

Keep attribution attached. Author, rating, date, link. If a tool strips any of those, it is not saving you space, it is removing the thing that makes the display a quotation.

Never invent one. This is obvious, and it is still the largest category of enforcement action in the sector.

How we handle it

The reason to run this through JustReview rather than assembling it yourself is that the compliant shape is the default and you cannot accidentally break it. Google reviews arrive through the official API after you authorise your own profile, every card renders with the reviewer’s name, their star rating, the date and a link back to the review on Google, and the text is displayed as written. There is no editing field, because there should not be one. Revoking our access in your Google account cuts the connection immediately, without asking us.

The same applies to everything else you connect, which matters more than it sounds: 880 of our accounts hold reviews from more than one platform, and a widget is only as defensible as its sloppiest source. When a platform tells us to stop, we stop, and the numbers above are what that looks like in practice rather than in a policy page.

Two honest caveats. This post describes how we built the product and what our data shows; it is not a legal opinion, and if you operate somewhere with sector-specific advertising rules, health and finance being the obvious ones, ask someone qualified before you publish. And we can only guarantee the handling of reviews that come through us. Reviews you paste into a page by hand, from any tool, carry whatever attribution you gave them.

The short version

Embedding Google reviews on your own site is legal, Google provides the API that makes it legal, and the conditions are consent from the profile owner, attribution on every review, and no editorial hand on the selection. The risk that actually materialises comes from sources that sell widgets, not from Google, and we have the deleted rows to prove it.

If you want the compliant version without building it, create an account, connect your Google profile and put a Google reviews widget on your site. The free plan carries up to 100 reviews without a card, the pricing page covers the rest, and if Google is still your only source, the reviews you already have elsewhere are worth collecting under the same rules.