Google review requests for restaurants: a compliant checklist

You can ask every diner for a Google review, but you must ask every diner the same way. Google prohibits review gating, meaning filtering out unhappy guests, and any incentive for a review. Send one neutral request to opted-in guests within 24 hours of their visit, with a direct link to your Business Profile.

What do Google review requests do for your restaurant?

Fresh reviews keep your Business Profile current for diners who are choosing where to eat tonight. Google states that review count and review score factor into local search ranking. More reviews and positive ratings can improve where you appear in local results.

The commercial outcome is discovery first, then repeat visits. A diner who finds you through Maps becomes a guest. If that guest opts in on your guest WiFi, they become a contact you can bring back. The same consented list that carries your review request also carries your next midweek offer.

The mechanism is consistency. Unprompted reviews arrive at random, and you control neither their volume nor their timing. A structured programme asks every guest, at a predictable moment, through a channel you can measure.

Why compliance is part of the result

A review programme that breaks the rules can cost you more than it earns. Google's policy on fake engagement lets it remove reviews that breach the rules. It can also restrict Business Profiles involved in fake engagement, including blocking new reviews for a period.

The legal exposure is growing too. In the UK, the Digital Markets, Competition and Consumers Act 2024 bans fake reviews and concealed incentivised reviews. Those provisions took effect on 6 April 2025. The Competition and Markets Authority (CMA) can now fine businesses directly, up to 10% of global turnover. In the US, the Federal Trade Commission's rule on consumer reviews took effect in October 2024. It prohibits fake reviews and review suppression, and violations can attract civil penalties.

What do you need before you send a Google review request?

Six things need to be in place before your first send. Each takes an afternoon, not a project.

A verified Business Profile and review link for every site

Each restaurant location has its own Business Profile and its own review link. Google Business Profile lets you copy a short link that opens the review form directly. Store one link per site. A multi-site group that sends every diner to the flagship's profile muddies ratings across the estate.

A lawful basis and consent records

The General Data Protection Regulation (GDPR) requires a lawful basis for processing personal data. For email marketing, that basis is usually consent. Article 4(11) defines valid consent as freely given, specific, informed and unambiguous. Article 7(3) requires withdrawal to be as easy as giving it.

In the UK, the Privacy and Electronic Communications Regulations (PECR) also govern marketing emails. The ICO treats a message as direct marketing if it promotes your business. A review request that mentions a menu, an event or an offer is direct marketing. The safe default is to send review requests only to guests who opted in.

One message for every guest

Write a single review request that goes to every eligible diner. No version for regulars who love you and another for first-timers. Same wording, same link, same timing logic.

A separate route for private feedback

Some guests want to tell you something without posting it publicly. Offer a private feedback link, but alongside the Google link, never instead of it. Both options appear in the same message, for every guest.

A frequency cap

Decide how often one guest can be asked. We suggest no more than one request per guest every 90 days. Regulars who visit weekly should not receive a weekly review request.

An owner for replies

Google recommends replying to reviews, positive and negative. Name the person who replies at each site, and set a target such as replying within two working days.

What Google and UK law allow

Practice	Google policy	UK law (DMCCA 2024)	What to do instead
Ask every diner for a review with one neutral message	Allowed	Allowed	Make this your default
Ask "Did you enjoy your meal?" first, then send only happy diners to Google	Prohibited: selective solicitation of positive reviews	High risk: can present reviews in a misleading way	Show the Google link to every guest, with private feedback alongside
Offer a discount, free drink or loyalty points for a review	Prohibited: incentives for reviews	Concealed incentivised reviews banned	Keep offers in separate messages, never tied to reviewing
Staff or owners write reviews of their own venue	Prohibited: conflict of interest	Fake reviews banned	Ask staff to mention the review link at payment
Pay a third party to post reviews	Prohibited: fake engagement	Commissioning fake reviews banned	Grow reviews from real guests only
Reply publicly to every review	Encouraged	Allowed	Reply within two working days, calmly and specifically

How do you build the review request list from guest WiFi data?

Most email platforms send campaigns well. Mailchimp, Klaviyo and HubSpot all do that. None of them builds the list for a physical venue. You still need a way to capture diners' details, with consent, while they are in the room.

Purple Engage, the CRM and email marketing platform for physical venues, closes that gap. The list builds itself from guest WiFi logins. Each record is consented, first-party data, tied to the venue and the time of the visit. Purple runs across 80,000+ live venues and processed 440 million logins in 2024 (Purple data).

Step 1: set your opt-in wording

When diners log in to your Guest WiFi, they see a conscious-choice opt-in for marketing. It is unticked by default. Say plainly what they will receive, for example "Occasional emails from us, including a request to review your visit". That wording makes the review request part of what they agreed to, which satisfies Article 4(11).

Step 2: map each site to its Google review link

Store each venue's review link against that venue in Purple Engage. A guest who logs in at your Leeds site gets the Leeds link. Check every link by opening it on a phone before launch.

Step 3: trigger the send from the visit

The WiFi login gives you the one data point a generic email tool lacks: when the guest was actually there. Use the visit as the trigger for the review request, so timing follows real behaviour rather than a weekly batch.

Step 4: apply eligibility rules that ignore sentiment

Exclude guests on criteria that have nothing to do with how they felt. Valid exclusions include anyone asked in the last 90 days, staff devices and guests who withdrew consent. Never exclude a guest because they complained, left a low survey score or looked unhappy. That is gating.

Step 5: decide where you send from

You can send directly from Purple Engage. If your team prefers to stay in another platform, Purple Connectors push data from Purple into external systems. You can then send communications externally using the consented guest data. The setup steps are in our support article, Introduction to Connectors.

Purple is hardware-agnostic. It works with the access points you already run, including Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet.

Worked scenario: a 90-cover neighbourhood restaurant

The figures in this scenario are illustrative assumptions, not Purple results.

Situation. An independent restaurant relied on a QR code printed on its table cards. It had no way to tell which diners scanned, and no way to follow up. Reviews arrived in uneven bursts, mostly after busy weekends.

What was done. The team switched on guest WiFi with a conscious-choice opt-in. Assume 1,200 diners log in each month and 30% opt in, which gives 360 contactable guests. Each received one review request the morning after their visit, with the 90-day cap applied.

Measurable outcome. Assume 25% of recipients click and one in four of those leaves a review. That gives roughly 22 new reviews a month from email alone, on top of table-card reviews. More importantly, the restaurant gained 360 consented contacts a month for repeat-visit campaigns. Your own rates will differ, which is why the measurement section below matters.

What should a compliant review request say, and when should you send it?

The best request is short, neutral and sent while the meal is still fresh. Three rules cover most of it: ask everyone, ask once and ask soon.

When to send, by visit type

Visit type	When to send	Why
Weekday lunch	Same day, mid-afternoon	Diners are back at their desks and the meal is recent
Weekday dinner	Next morning, around 10:00	Avoids a late-night email; the evening is still fresh
Weekend brunch	Same day, early evening	Leisure time, and the visit was hours ago
Hotel restaurant during a stay	After checkout	One request covers the whole stay, not each meal
Private dining or events	Next working day	Gives the organiser time to gather feedback from the group

Send no more than one reminder, and only to guests who did not open the first message. If you send a reminder, send it within seven days. After that, the visit has faded and the request reads as noise.

What to write

Keep the message to four parts: thanks, one question, two links and the unsubscribe. Here is a pattern you can adapt.

Subject: Thanks for joining us at [Venue] yesterday

Thank you for eating with us. Would you share your experience on Google? It takes about a minute and helps other diners decide where to eat.

[Leave a Google review]

If you would rather tell us something privately, reply to this email or use our feedback form.

[Send private feedback]

Notice what is missing. There is no "If you loved it, review us on Google". There is no star rating to click before you see the Google link. There is no offer. Those three omissions keep the message inside Google's policy and UK law.

Keep promotions in separate emails. A review request that also pushes your new tasting menu becomes direct marketing under PECR. It also invites the suspicion that the offer and the review are linked.

Which channels to combine

Email from guest WiFi data is your measurable core channel. In-venue prompts reach diners who did not opt in. Use both, with the same neutral wording.

Channel	When it reaches the diner	Consent needed	What you can measure	Best for
Post-visit email from guest WiFi data	2 to 24 hours after the visit	Yes: GDPR consent and PECR opt-in	Sends, opens, clicks per site	Your core, repeatable programme
Table card with QR code	During the meal	No: the diner chooses to scan	Scans, if you use a short link with counting	Diners who did not opt in
Bill or receipt footer	At payment	No	Little, unless the link is unique	Low-effort reinforcement
Staff mention at payment	At payment	No	Nothing directly	Building a review culture on the floor
SMS	2 to 24 hours after the visit	Yes: opt-in for SMS marketing	Sends, clicks	Takeaway and quick-service venues

How do you know your review requests are working?

Measure outcomes at the site level, monthly. A single estate-wide number hides the sites that need help.

The six numbers to watch

• New reviews per site per month. Your headline volume measure. Compare it with the three months before launch.
• Reviews per 1,000 WiFi visits. This normalises for busy and quiet sites, so a 40-cover bistro and a 200-cover brasserie compare fairly.
• Average rating, rolling 90 days. Watch the trend, not the all-time figure, which barely moves once you have hundreds of reviews.
• Click rate on the review link. Measured in your email platform. A falling click rate usually means fatigue or poor timing.
• Reply rate and reply time. Reviews you answered, and how fast. Google Business Profile shows every review in one place.
• Opt-in rate on guest WiFi. The size of next month's list depends on this, so it is a leading indicator.

Google Business Profile's performance view also shows how diners found you, including searches and Maps views. Look for rising profile interactions in the months after launch.

The same visit data that times your review request can measure paid media against real visits. See Meta Conversions API integration for restaurants: measuring ads against real visits.

Worked scenario: a 12-site pub and restaurant group

The figures in this scenario are illustrative assumptions, not Purple results.

Situation. A regional group sent diners a one-question survey: "How would you rate your visit, 1 to 5?" Guests who chose 4 or 5 then saw a Google link. Guests who chose 1 to 3 saw a feedback form instead. That is textbook gating, and the DMCCA came into force while it was still live.

What was done. The group replaced the survey with one neutral email to every opted-in guest. Both links appeared in every message. Each site got its own review link, and each general manager owned replies for their site.

Measurable outcome. Assume the rolling 90-day average rating eased from 4.6 to 4.4, as some less happy guests now reached Google. Assume monthly review volume rose by half, because no guest was filtered out. The group removed a policy breach and a legal risk, and gained an honest signal of which sites needed attention. Two sites with falling ratings got a menu and staffing review within the quarter.

Expect a small dip in average rating when you stop gating. That dip is the true picture, and fixing what it reveals is what lifts repeat visits.

What goes wrong with restaurant review requests, and how do you avoid it?

Most failures are not deliberate. They creep in through well-meant tweaks. Here are the common ones.

Gating by another name

"Tell us how we did first" screens look harmless. If the Google link only appears after a positive answer, it is gating. Run this test: does every guest see the Google link, in the same place, regardless of what they clicked? If not, fix it.

Incentives creeping in through loyalty

A loyalty team adds "50 points for a Google review" to the app. A server promises a free dessert. Both breach Google's policy, and concealed incentives breach UK law. Brief your loyalty, marketing and floor teams together, in writing.

Asking the same regulars every visit

Your best guests visit most, so a visit-triggered send hits them hardest. Without a frequency cap, they unsubscribe, and you lose your most valuable contacts. Apply the 90-day cap before launch, not after the complaints.

Sending to people who never opted in

Uploading a list of past bookings and sending review requests to everyone is a PECR problem. It is also a GDPR problem if you lack a lawful basis. Use only consented contacts. If a booking platform holds the data, check its consent terms first.

Wrong link in a multi-site estate

A single shared link sends every review to one profile. One site looks busy, the rest look abandoned. Test every site's link on a phone before each new site goes live.

Staff posting reviews on venue devices

Staff writing reviews of their own workplace is a conflict of interest under Google's policy. Reviews posted from your venue's network can also look suspicious in bulk. Ask staff to point diners to the link, never to write reviews themselves.

Ignoring the negative reviews you now receive

Ungated requests surface honest criticism. Leaving it unanswered tells future diners nobody is listening. Reply specifically, offer to continue offline and fix the underlying issue.

Worked scenario: a café in a garden centre

The figures in this scenario are illustrative assumptions, not Purple results.

Situation. A retail garden centre ran a café that drew shoppers at weekends. The café's Business Profile held reviews of the plant department, because shoppers confused the two. The team also offered a free coffee for any review shown at the till.

What was done. The garden centre withdrew the free coffee offer immediately. It created separate review links for the café and the main store. Shoppers who logged in to guest WiFi in the café zone received the café link. Shoppers elsewhere received the store link.

Measurable outcome. Assume reviews mentioning plants on the café's profile fell from one in three to near zero within two months. The café could then see feedback on its own food and service. It removed an incentive that breached Google's policy and the DMCCA.

For the next step with the same consented list, see our related guide on Meta custom audiences from guest WiFi data, a checklist for venues.

Frequently asked questions

Is it against Google's rules to ask diners for reviews?

No, Google allows you to ask guests for reviews. What it prohibits is selective solicitation, meaning asking only diners you expect to be positive, and offering anything in return. Ask every eligible guest the same way, with the same message and link. Google Business Profile even gives you a short link to share, which opens the review form directly on a diner's phone.

Can we give diners a discount or free drink for leaving a Google review?

No. Google's policy prohibits offering money, products or services in exchange for reviews, whether the review is positive or negative. In the UK, the Digital Markets, Competition and Consumers Act 2024 bans concealed incentivised reviews, with CMA fines of up to 10% of global turnover. Keep your offers and review requests in separate messages, and never make an offer conditional on reviewing.

Do we need consent to email a Google review request to diners?

Yes, treat it as marketing and send only to opted-in guests. The ICO regards a message that promotes your business as direct marketing under PECR. GDPR requires consent that is freely given, specific, informed and unambiguous. Purple captures a conscious-choice opt-in at guest WiFi login, unticked by default. Name review requests in that opt-in wording, so guests know what they agreed to receive.

Can we send happy diners to Google and unhappy ones to a feedback form?

No, that is review gating and it breaches Google's policy. You can offer a private feedback option, but every guest must see the Google link too, in the same message. The test is simple: if any answer a guest gives changes whether they see the Google link, you are gating. Remove the screening question and show both options to everyone.

How is Purple Engage different from Mailchimp or Klaviyo for review requests?

Purple Engage builds the list, which Mailchimp and Klaviyo do not. Those platforms send campaigns to contacts you already have. Purple Engage creates consented, first-party contacts from guest WiFi logins, tied to the venue and time of each visit. That visit data lets you time each review request to a real visit and send each guest the right site's Google link.

Will Purple work with the WiFi hardware we already have?

Yes, Purple is hardware-agnostic and runs on the access points you already own. Supported hardware includes Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. You do not need to replace your network to capture consented guest data. Purple is live in 80,000+ venues and handled 440 million logins in 2024 (Purple data).

Can we keep sending review requests from our existing email platform?

Yes. Purple Connectors push data from Purple into external systems, so you can send communications from another platform using consented guest data. Many venues capture contacts in Purple and keep their existing sending tool. The setup steps are in our support article, Introduction to Connectors. Check that each site's Google review link travels with the guest record.

How soon after a visit should a restaurant send a review request?

Send within 24 hours of the visit, while the meal is still fresh. For dinner, the next morning works well. For lunch or brunch, the same afternoon or early evening suits most diners. Send no more than one reminder, within seven days, and cap requests at one per guest every 90 days, so regulars are not asked each visit.