CMA review cases: who answers for a suppressed review

The CMA has open consumer protection cases under the Digital Markets, Competition and Consumers Act 2024 into five businesses over online reviews: Autotrader, Feefo, Dignity, Just Eat and Pasta Evangelists. The cases were opened on 26 and 27 March 2026.

This article concentrates on the Feefo case, because it involves a review provider and a customer that displays the provider’s output. That is the relationship most review, ratings and reputation software contracts govern.

Dignity, Just Eat and Pasta Evangelists are named in the same group of cases. The CMA has not published findings against any of the five, and the cases should not be read as having established anything about the others from the Feefo facts.

The facts in the CMA’s case are about suppression. One-star reviews were moderated by Feefo, were not published on Autotrader’s platform and were not counted in the star ratings. A star rating that omits some reviews can present a better picture than the underlying feedback would give.

That structure matters commercially. The review provider moderates, the customer publishes, and the consumer sees one score. The CMA is looking at how responsibility is shared between those two parties, and a contract that is silent on the point leaves the answer to inference.

A reader should keep two things apart. The first is the allegation that moderation removed unfavourable feedback from the published picture. The second is the question of how liability is shared between a provider that moderates and a customer that displays. Only the second is a contract question, and it can be answered without deciding the first.

The CMA’s case page shows the latest update on 28 September 2026. It records that evidence gathering has been under way from March to September 2026, that no finding has been made, and that the next update is expected in winter 2026-27. The CMA has stated that there is no legal deadline.

The 28 September entry is a timetable update only. It is not a new finding and should not be reported as a development against any party. A business should treat the cases as open questions that signal the CMA’s interest, not as established law.

The status of the cases is therefore a reason to prepare, not to wait. Evidence gathering continues, and contract terms agreed now will be the terms a regulator reads if the matter moves to a finding. Terms agreed after a finding will look reactive.

Under the 2024 Act the CMA can fine directly, with penalties that can reach 10% of global turnover. Before that power existed, the cost of a consumer protection failure was often a negotiated undertaking. A direct fine is a different order of risk and it will be assessed against the party the CMA considers responsible.

That puts pressure on liability clauses. A standard cap sized to annual fees may bear no relation to a regulatory penalty or to the cost of redress. If the contract does not say who bears a CMA penalty arising from moderation or display decisions, the allocation will be argued after the event, between parties who both have exposure.

For a supplier, the sensible exercise is to model a penalty at the top of the range against the existing cap and indemnity wording and see who ends up paying. For a buyer, the same exercise should ask whether the supplier is able, and contractually required, to stand behind its moderation decisions.

In practice three decisions are blended: the rule for removing or holding a review, the act of applying it, and the choice to publish or count what remains. A provider may control the first two while the customer controls the third, or the other way round. The CMA’s cases make clear that regulators look at the whole chain.

Buyers should know whether the platform is moderating on their instructions or on its own policy, and suppliers should know whether the customer can override a decision. Each side should be able to evidence its part. That is a documentation and audit question as much as a liability one, and it is best settled in the contract before a regulator asks.

Treat the answer as a chain of evidence. If a regulator asks why a review was not counted, each party should be able to produce its own record: the supplier of how the rule was applied, the customer of what was published and why. A contract that requires those records to be kept, and shared on request, is doing real risk management.

The following points are drafting suggestions for anyone buying or supplying review, ratings or reputation software. They are advice on allocating risk, not a statement of what any court or the CMA has held.

• Set moderation and publication rules in writing, stating the grounds for holding or removing a review and who applies them.
• Give the customer audit rights over moderation, including access to records of reviews held, removed or excluded from ratings.
• Add warranties on moderation practice, for example that reviews are not suppressed on grounds of sentiment or star rating.
• Allocate CMA penalties and redress by indemnity, rather than leaving the allocation to implication, and test the liability cap against regulatory exposure.
• Record who controls publication and star-rating calculation, and provide a cooperation clause for any CMA information request.