A customer sends a generous email after a project. The message would fit your website perfectly, so someone copies it into a testimonial card and adds the customer's photograph from LinkedIn. A friendly note has quietly become a public endorsement with identifying information attached.
A testimonial permission form can prevent that confusion, but the form is only useful when it describes the real proposed use. A broad sentence about marketing rights does not replace a clear conversation about the quote, attribution and publication channels.
Agree the actual quote and identity
Send an approval request that makes the proposed publication easy to check. Include:
- the exact quotation, with any proposed shortening already visible;
- the name and role you plan to show, using the customer's preferred spelling;
- any company name, logo or photograph, with approval from the appropriate person;
- the places where the material will appear, such as the website or a sales presentation;
- any translation, cropping or other planned edit that could affect the presentation.
Keep these details together. A customer should not have to open several versions of a file to work out what they are approving.
The ASA's advice on claims and testimonials explains that advertisers need permission and evidence, and that a testimonial does not substantiate every effectiveness claim it contains. Approval to use words and evidence for the claim are related but different questions.
A customer can approve an account of their experience without being able to authorise a wider corporate endorsement. Keep the attribution proportionate to what they have actually agreed.
Describe the channels and the purpose
Say whether the quote will appear on a public website, in sales materials, in email or in advertising. If you want several uses, list them clearly. Include whether you intend to shorten the quote, translate it or combine it with a photograph.
Where you rely on consent to process personal data, the ICO's explanation of valid consent is a useful UK reference: the person needs a genuine, informed choice. The relevant legal basis and requirements depend on the circumstances and market; a testimonial template is not a universal privacy solution.
For customers in Germany or elsewhere in the EU, assess applicable data protection, image rights and advertising requirements. For Australia and the United States, consider the relevant privacy and advertising rules as well. An international website should not assume that approval language written for one country resolves every use elsewhere.
Keep a record your team can act on
Record what the customer saw, what they approved and when. Give them a straightforward contact route for corrections or concerns. Agree how your business will review a request to stop future use and what it can practically change in materials already distributed.
The ICO's guidance on obtaining and managing consent explains the importance of retaining evidence of consent and managing it over time. That record should be accessible to the people responsible for publishing, rather than buried in one former employee's inbox.
Review attribution when a customer changes jobs or the service changes substantially. An old approval should not be treated as permission to attach the quote to a different product or a new claim.
Connect permission to the published version
Before adding a manual testimonial to Mirror App's Reviews Widget, compare it with the approved text and identity. Store the approval in your own records and note where the quote is used. This is an editorial control your team maintains; displaying the testimonial does not itself establish that permission has been obtained.
