A Review Exposing Personal Information: Report Before You Reply

A review that includes your employee's mobile number. Or a photo of an invoice with another customer's name on it. Or text saying "Dr X treated my wife for…".

This category differs from every other negative review: it involves a third party who never chose to be there. And handling it is faster and clearer than anything else — because the policy basis is strong.

Key takeaways:

• Personal information is the strongest and fastest-accepted category of report.
• Report immediately, before replying and before anything else.
• The person concerned can report it themselves, and their report carries more weight.
• Never repeat the information in your reply — not even to deny it.
• The most serious case: a review exposing health information.

What counts as personal information

Google's policy prohibits distributing or posting personal information without consent, defining it as information applying to a living identifiable person whose disclosure could cause harm. It names explicitly:

"Personally identifiable information and other personal information about yourself or others including financial information, medical information or personal identification information"

And also: "their full name, or their face in a photograph or a video" posted without consent (Prohibited & restricted content).

In practice, report immediately:

• A mobile number or personal email for anyone.
• A photo of an invoice or document carrying a customer's name or number.
• A photo clearly showing an employee's or customer's face.
• Any reference to a health condition or treatment for a specific person.
• Financial details: amounts tied to a name, account numbers.

What doesn't count: an employee's first name, a doctor practising publicly under their own name, or your own business contact details (your phone, email, address) — those are explicitly allowed.

The order: report first, then reply

Invert your usual order. In every other case we advise replying within 24 hours and reporting after; here it's the reverse.

Why: every hour it stays is longer exposure of a person's data they never agreed to. And this report type is among the fastest accepted, because it needs no interpretation — the information is either visible or it isn't.

1. Screenshot for the record.
2. Report, selecting the personal-information reason. Steps in reporting a policy-violating review.
3. Tell the person concerned — Google lets whoever's data was posted report it themselves, and their report is stronger because the right is theirs.
4. Reply using the wording below.

The reply: don't repeat the information

The most dangerous thing an owner does here is reply with a correction:

❌ "The number listed, 05xxxxxxxx, is not our employee's number."

You denied it and pinned it to the page a second time — this time in your official voice.

The correct shape ignores the information entirely:

We're sorry about your experience and would like to resolve it with you directly. Email us at [email] and we'll follow up there.

Short, no reference to what was posted, neither confirming nor denying it.

⚠️ If the information is medical — a condition or treatment named for a person — the reply is narrower still: don't even confirm the person was yours. The full wording is in clinic reviews: replying without disclosing.

When the data is yours

A customer publishes your full name or personal number in an angry review. Here you are the person concerned, and you can report as the data subject rather than as the business owner — a stronger route.

But note: business contact details are allowed. The shop's number, email and address are not personal information, however much their publication annoys you.

What if the report is rejected?

It happens, especially with a first name or an ambiguous detail. Then:

• Don't resubmit the same wording: Google rejected your report?
• Ask the person concerned to report it themselves. That's the most important remaining step.
• If the information is genuinely sensitive and stays, the legal route exists but is slow: defamatory reviews and the law.

FAQ

A photo of an invoice with another customer's name — is it removed?

A strong basis for a report. The photo exposes a third party who never took part in the review.

A customer posted a photo of my employee without her permission?

"Their face in a photograph" is named in the policy. Report it, and ask the employee to report it too.

Should I ask the customer to remove the detail?

You can reach out calmly once. But don't make that a substitute for the report — the conversation may fail, and the report costs nothing.

How long does removal take?

No published duration, but this category is usually faster than others because the criterion is unambiguous.

The bottom line

This is one of the few situations where you are clearly in the right with explicit policy text behind you. Use it in the correct order: report immediately, involve the person concerned, and reply without repeating the information.

The one mistake that undoes all of it is republishing the detail yourself in a defensive reply.

And while this case is handled, the rest of your reviews keep arriving and still need answering. Raddly gathers them in one place and drafts a reply for each in your business's voice, so nothing piles up while you deal with the exception.