How to Get Consent for a Testimonial the Right Way

Consent is valid when the customer understood exactly what they were agreeing to, agreed without pressure, and you can prove it afterwards. That last clause is the one businesses miss. Under GDPR Article 7, where consent is your basis for processing someone’s data, “the controller shall be able to demonstrate that the data subject has consented.” Not “the customer definitely said yes.” Demonstrate.

A nod at the mirror is not evidence. It might well have been perfectly valid consent — and you will still have nothing to show for it the day someone changes their mind, gets a lawyer, or simply asks you what precisely they agreed to.

A face and a voice are personal data

Some owners assume this is paperwork for large companies. It is not. A recognisable face, a recorded voice, a first name, an Instagram handle — each of these identifies a person, which makes them personal data, which brings the whole thing inside data protection law. Publishing them is processing.

You do not need a legal department. You need to have actually asked, and to be able to show that you asked. The bar is lower than owners fear and higher than a verbal “yeah, go ahead.”

What the consent must actually cover

The most common failure is not the absence of consent. It is consent that was too narrow for what you then did with the recording.

The customer agreed to be filmed. That is not the same as agreeing to be published. Which is not the same as agreeing to be published on TikTok. Which is not the same as agreeing to be tagged, so that everyone they know receives a notification about it.

Each of those is a separate step, and each one has to be inside what they said yes to. So the consent has to name:

• Who is publishing — the business, by name. Not “us”, not a brand they have never heard of.
• What content — this recording, this photo, made today.
• Where — the channels. Facebook, Instagram, TikTok, and any others you actually use.
• Whether they are tagged — and with which handle. Being tagged is a public act with real consequences for the customer’s own network; it must be its own, optional decision.
• How to change their mind — who they contact, and what happens then.

If your consent covers all five, you are in good shape. If it covers “can I film you?”, you are not, and the gap is exactly where the trouble lives.

Freely given means the no has to be free

Consent obtained under pressure is not consent, and the pressure does not have to be dramatic to count.

A hotel guest at the desk, being asked by the manager, with a queue behind them, is in a socially awkward position. If they feel that saying no will make things uncomfortable — with the person who controls their room, their upgrade, their late checkout — then their yes was not freely given, whatever they signed.

This is not a legal abstraction. It is the same practical rule that makes testimonials good in the first place: the no has to cost the customer nothing. Ask once, accept the answer, move on. A customer who was talked into it produces a stiff, reluctant recording that persuades nobody, and now you have a bad testimonial and a consent problem, which is an impressive way to lose twice.

Say the sentence, hold out the phone, and if they hesitate, let them off. “Of course, no problem” is the entire recovery.

Consent can be withdrawn, and you must be able to act on it

Article 7 is direct about this: the customer has “the right to withdraw his or her consent at any time,” and it must be “as easy to withdraw as to give consent.”

Withdrawal is not retroactive — it does not make the months the video was up unlawful. But from the moment they ask, the content comes down. On every channel you put it on.

Which produces a practical requirement that nobody thinks about until the phone call comes: you have to know where you posted it. A testimonial published by hand to four platforms over a busy fortnight is a testimonial you will be hunting for. If you cannot answer “where is Maria’s video?” in under a minute, you cannot honour a withdrawal properly, and a customer asking you to take their face off the internet is not a customer who wants to wait a week.

Keep a record of what went where. This is the unglamorous half of consent and it is the half that actually gets tested.

Why the signature is the point

In ciaopost the customer signs on the phone, with their finger, before anything is published. It looks like signing for a parcel, and it takes about four seconds.

That signature is not decoration, and it is not there to intimidate anyone. It exists because of the demonstrate requirement above. It captures, in one artefact, at one moment: this person, agreeing to this content, going to these channels, tagged at these handles — and the signature that ties them to it.

It also does something quieter and more useful. It makes the customer read the thing. A verbal yes is given in half a second, on trust, often without full attention. A screen that says “I authorise [Business] to publish this content on social media and to tag my profiles”, with a place to sign, forces two seconds of actual comprehension. The customer who signs that has genuinely understood what is about to happen, which is the entire point of consent and the reason so few of them ever come back with a complaint.

And the handles are optional, deliberately. A customer can consent to being published and decline to be tagged, and those are two different boxes, because they are two different decisions.

The four seconds that keep you safe

Get consent in the room, at the moment of recording, in a form you can show someone later. Cover the five things. Let the customer say no without paying a price for it. Know where you published, so you can take it down when asked.

That is not a compliance programme. It is four seconds at the end of a service, and it converts a warm moment into something you can actually use — publicly, for years, without a knot in your stomach.

If you want to know what has to be in that form, testimonial release forms sets out what you actually need and what you can safely skip.