Online reviews and defamation: a guide for reviewers and for businesses

Reviews on Google, Facebook, ProductReview, Yelp, RateMDs, TripAdvisor and industry sites shape where people spend money and which practitioners they trust. A one star review can be read by thousands of prospective customers, and so can the response. Both sides of that exchange can end up in a defamation dispute.

The first half of this article is for people who want to write an honest review without being sued. The second is for businesses and professionals who have received a damaging review, and covers fake reviews, public responses and what courts have awarded.

Reviews are publications

A review is published when it is read by someone other than the person it is about. The reviewer is the author and primary publisher. The platform may be a publisher, subject to the digital intermediary defences, and anyone who shares or quotes the review republishes it.

Meaning is judged by how an ordinary reasonable reader would understand the review in context. A star rating alone may convey little; a review that says a tradesperson “took the deposit and never came back” or that a doctor “should not be practising” conveys specific allegations about honesty or competence, and the question becomes whether the reviewer can defend them.

For reviewers: writing a review that can be defended

The two defences that matter most are justification (truth) and honest opinion. Under s 25 of the Defamation Act 2005, it is a defence if the defendant proves that the defamatory imputations carried by the matter are substantially true.¹ The burden sits on the reviewer, so statements of fact should be confined to things the reviewer experienced or can prove with documents, photographs or messages.

The honest opinion defence under s 31 protects an expression of opinion, rather than a statement of fact, on a matter of public interest, provided the opinion is based on proper material.² Material is proper if it is set out in the review in specific or general terms, is notorious, is accessible through a link, or is apparent from the context, and if it is substantially true or otherwise protected.² The defence is defeated only if the plaintiff proves that the opinion was not honestly held.² The way a business provides goods or services to the public has been treated as a matter of public interest for this purpose.²¹

Practical points follow:

• Separate facts from conclusions. “The repair failed within a week and the shop refused a refund” must be proved. “In my view the service was poor value” is defensible if the facts behind it are set out and true.
• Avoid allegations of crime, fraud, incompetence or professional misconduct expressed as fact. Calling a practitioner “a scammer” asserts dishonesty; unless that can be proved, truth is unavailable and the statement is unlikely to be treated as opinion.
• Describe the reviewer’s own experience rather than repeating what others have said. Repeating an allegation republishes it.
• Review only a business actually dealt with. A review by someone who was never a customer is the clearest case for a plaintiff and a potential breach of consumer law.
• Keep invoices, quotes, messages and photographs. They are what make a truth defence work.
• Do not write out of spite. In Cheng v Lok, the Supreme Court of South Australia found that a reviewer who had never dealt with the lawyer she reviewed was acting without good faith, and awarded aggravated damages on that basis.³

Anonymity is not protection. Platforms and internet providers hold account and connection data, and courts have ordered its disclosure. In Kabbabe v Google LLC, a dentist obtained leave to serve Google in the United States with an application for preliminary discovery under r 7.22 of the Federal Court Rules 2011 (Cth) to identify the author of a pseudonymous Google review; the applicant need not show a prima facie case, only that they may have a right to obtain relief against the unknown reviewer.⁴ In Colagrande v Telstra Corporation Ltd, a subpoena to the owner of RateMDs produced the reviewer’s IP address, and Derrington J ordered Telstra to disclose the account holder, describing the threshold as “very low” and “not onerous”.⁵

For businesses: who can sue over a review

The first question for a business is whether it has a cause of action at all. Under s 9 of the Defamation Act 2005, a corporation cannot sue for defamation unless it was an excluded corporation at the time of publication: a not for profit body, or a corporation with fewer than ten employees that is not an associated entity of another corporation, and in either case not a public body.⁶ Part time employees count as a fraction of a full time equivalent, and “employee” includes contractors engaged in day to day operations under the corporation’s control.⁶

Many small companies will qualify. Larger companies and subsidiaries will not, and must look to injurious falsehood or misleading or deceptive conduct, both of which require proof of falsity.

Section 9 does not prevent the individuals behind the business from suing. Section 9(5) preserves the cause of action of an individual associated with a corporation if the publication also defames the individual.⁶ A review that names or clearly refers to the owner, practitioner or tradesperson defames that person, and sole traders and partners are individuals in any event. Most review litigation is brought by individuals, as in the lawyer, dentist and doctor cases discussed here.

Outside Western Australia the plaintiff must also prove serious harm. Section 10A(1) makes it an element of the cause of action that the publication has caused, or is likely to cause, serious harm to the plaintiff’s reputation, and s 10A(2) provides that harm to an excluded corporation is not serious harm unless it has caused, or is likely to cause, serious financial loss.⁷ A company therefore needs evidence of lost customers or a measurable fall in revenue attributable to the review. An individual needs evidence of serious reputational harm, which is easier with proof of actual consequences such as patients leaving a practice.

What a business can realistically do

There is a sequence of steps, and litigation is usually the last of them.

The first is to weigh the Streisand effect: whether action will draw more attention to the review than it attracted on its own. Proceedings are public, judgments are published and reported, and the review will be quoted in them. For a review that is merely unflattering, a calm public reply and a request for direct contact is often the better course.

The second is a platform complaint. Every major platform has a process for reporting reviews that breach its policies, such as personal attacks or reviews from someone with no customer relationship. Where enacted, s 31A also gives platforms a defence if they maintain an accessible complaints mechanism and take reasonable access prevention steps within seven days of a written complaint that identifies the complainant, the matter and its location and states that the complainant considers it defamatory.⁸ A complaint in that form creates an incentive to act, because leaving the review up after seven days puts the defence at risk.

The third is a concerns notice. Proceedings cannot be commenced unless the aggrieved person has given the proposed defendant a concerns notice, the imputations relied on were particularised in it, and the applicable period for an offer to make amends, ordinarily 28 days, has elapsed.⁹ The notice must specify where the review can be accessed and, if practicable, attach a copy.⁹ A concerns notice to the reviewer often results in removal or an apology.

Where the reviewer cannot be identified, preliminary discovery under the rules of the relevant court can compel the platform, and then the internet provider, to disclose account information, as in Kabbabe and Colagrande v Telstra.^{4 5} Where s 23A has been enacted, the court must consider the objects of the Act and any privacy, safety or other public interest considerations before making such an order.¹⁰ The exercise is slow and costly, although the costs may be recoverable as special damages if the reviewer is found liable, as in Colagrande v Kim.¹¹

Finally, if a review alleges serious misconduct, is false, was widely read and caused real loss, proceedings for damages and an injunction may be justified. The limitation period is one year from publication, extendable in limited circumstances.

Responding to reviews publicly

A public reply is often the quickest way to limit damage, but a reply that calls the reviewer a liar or a fraud is itself a publication the reviewer can sue over, and the business will have to prove it true. A measured reply that states the business’s position without characterising the reviewer is safer.

Health practitioners are bound by confidentiality. The shared code of conduct adopted by the National Boards requires practitioners to protect patient privacy and not to post any person’s information, even if the person is not named, without written and informed consent.¹² A reply that confirms the reviewer was a patient, or discusses their treatment, will usually breach that obligation even if accurate. Ahpra also warns that engaging with reviews about clinical aspects of a service on a third party platform may amount to using a testimonial in advertising, which the National Law prohibits.¹³ Solicitors are in a similar position under rule 9 of the Australian Solicitors’ Conduct Rules, which prohibits disclosure of information confidential to a client to anyone outside the practice except in defined circumstances.¹⁴ A reviewer’s decision to publish does not of itself authorise a reply containing confidential detail.

For reviewers, the position is reversed: an apology or correction is admissible in mitigation of damages under s 38, and a prompt takedown and apology are often the end of the matter.¹⁵

Fake reviews, competitor reviews and review gating

Section 18 of the Australian Consumer Law, in Schedule 2 to the Competition and Consumer Act 2010 (Cth), prohibits a person in trade or commerce from engaging in conduct that is misleading or deceptive or likely to mislead or deceive, and s 29(1)(e) and (f) prohibit false or misleading representations that purport to be, or concern, a testimonial.¹⁶

The ACCC’s guidance states that it is against the law for a business to create fake or misleading reviews or to arrange for others to do so; that reviews by family, employees or paid individuals without disclosing the connection may be misleading; that suppressing or removing genuine negative reviews may mislead; and that incentives for reviews must be offered regardless of whether the review is positive or negative and be clearly disclosed.¹⁷ The ACCC accepts reports of fake reviews, and its guide says businesses affected by reviews motivated by personal reprisal should notify the platform promptly with reasons.¹⁷

Review gating, meaning steering satisfied customers to public review sites while diverting dissatisfied ones to private feedback, has been held to contravene the Australian Consumer Law. In Australian Competition and Consumer Commission v Meriton Property Services Pty Ltd, Moshinsky J found that Meriton had corrupted the email addresses of guests likely to have had a negative experience so that they would not receive TripAdvisor review invitations, creating a more favourable impression of its properties in contravention of ss 18 and 34.¹⁸

A competitor who posts a false review faces both consumer law and defamation exposure. In Colagrande v Kim, a rival cosmetic doctor and his wife posted a review on RateMDs written as if by a patient, implying that the plaintiff had sexually assaulted a patient when his conviction had been quashed. Jagot J found that they acted in concert to harm a perceived commercial competitor and awarded $420,000 for hurt feelings and injury to reputation (which the Act calls damages for non economic loss), a figure that included aggravated damages, plus $31,511.29 in special damages for the cost of identifying them, with permanent injunctions.¹¹ The case was decided under the law as it stood before 1 July 2021, under which an award of aggravated damages allowed the cap on general damages to be exceeded.¹¹

What courts have awarded

Cheng v Lok was an assessment of damages after default judgment, with no defence contested and substantial evidence of lost clients, and is not a guide to a contested case. Both cases predate the serious harm element and the current damages provisions, under which aggravated damages are awarded separately from capped general damages.¹⁹

Differences between jurisdictions

The Defamation Act 2005 provisions discussed here use the same numbering in New South Wales, Queensland, Victoria, Tasmania and South Australia. The ACT and Northern Territory have equivalent provisions under different section numbers in the Civil Law (Wrongs) Act 2002 (ACT) and the Defamation Act 2006 (NT). Queensland’s digital intermediary provisions, including ss 23A and 31A, commenced on 26 December 2025.²⁰

Western Australia has not enacted the 2021 reforms: there is no serious harm element, and therefore no requirement that an excluded corporation prove serious financial loss as an element of the claim, and there is no concerns notice precondition or s 31A defence. South Australia has enacted the digital intermediary provisions only in part. The Australian Consumer Law and the Ahpra obligations apply nationally.

Getting advice

Whether a review calls for a reply, a platform complaint, a concerns notice or proceedings depends on what it says, who wrote it, how many people read it and what can be proved. Reviewers who have received a concerns notice, and businesses or practitioners weighing a response, are both well served by advice before anything further is published.