Defamatory Reviews and Saudi Law: What Business Owners Should Know

Disclaimer: This article is general information, not legal advice. Raddly is not a law firm. Every case turns on its own facts, and any decision to pursue a legal route should rest on the opinion of a licensed lawyer in your jurisdiction.

Business owners routinely conflate two very different things: an honest bad review and defamation. The first is the customer's right, however harsh. The second may fall under Saudi Arabia's Anti-Cyber Crime Law. What separates them is not how much the review hurt — it is the nature of the content itself.

This guide sets out roughly where that line sits, and why the legal route should be your last option rather than your first.

Key takeaways:

• Honest criticism of your service is legitimate, even when it costs you customers.
• The Anti-Cyber Crime Law addresses defamation committed through information technology.
• Article 3: up to one year's imprisonment and/or a fine of up to SAR 500,000.
• The law applies to both sides — an owner posting fake reviews about a competitor is equally exposed.
• Always start with a reply and a report. The legal route is slow, costly, and rarely worth it.

What the law says

Saudi Arabia's Anti-Cyber Crime Law, issued by Royal Decree No. (M/17) of 1428H, addresses in Article 3 a set of acts committed through information technology, among them defaming others and causing them harm.

The penalty set out in that article is imprisonment for up to one year and a fine of up to five hundred thousand riyals, or either penalty (law text — Ministry of Finance).

Note the phrasing "up to." These are maximums, not automatic sentences. How any given incident is characterised is a judicial matter, not something settled by reading an article online.

Roughly where the line sits

Closer to legitimate criticism:

• "The food was cold and the service slow" — an opinion about an experience.
• "I waited 40 minutes and nobody apologised" — an event the customer recounts.
• "Overpriced for the quality" — a personal judgement.
• A one-star rating with no text — there is no content at all.

Closer to what a dispute may form around:

• A false and disprovable factual claim ("they sell spoiled meat," "they stole my wallet") from someone who never visited.
• Insults or personal degradation aimed at a named employee.
• A coordinated campaign from multiple accounts to sink a rating.
• Demanding money to remove a review — this is not discussed as a review at all.

The core distinction: are we looking at an opinion, or a false factual claim capable of being proven or disproven? Opinion is generally protected; the false factual claim is where disputes live.

⚠️ Do not use this split to judge your own case. It is a simplification for understanding; legal characterisation is a specialist's job.

The law cuts both ways

This part gets overlooked. The law does not protect business owners specifically — it applies to anyone, including you.

An owner who posts fake reviews about a competitor, or coordinates a negative campaign against one, stands in exactly the position they are complaining about. And in 2025 Google removed over 292 million policy-violating reviews and 13 million fake Business Profiles (Google blog) — detection is not remote.

The practical conclusion: the safe road does not run through answering fakes with fakes. The only path that cannot rebound on you is documenting, reporting, and replying politely in public.

Why legal action shouldn't be your first move

Even in cases that look clear-cut, the arithmetic usually works against you:

Time. Legal proceedings run for months. The review stays visible throughout unless Google removes it first.

Cost. Fees and follow-up, against an uncertain outcome.

Anonymity. Google does not disclose user data to business owners. Identifying the person is the first obstacle.

Potential backlash. Pursuing a customer over a review can become a bigger story than the review, particularly on social media.

The alternative is faster. Reporting through Google is free, takes days rather than months, and resolves most clear-cut fake cases.

The recommended sequence

1. Document immediately. Screenshot showing name, date, and full text. Everything later rests on this.

2. Check your records. Look for any trace of the visit or order. Its absence is a strong data point.

3. Reply publicly and calmly. Do not accuse anyone of lying. Safe wording: "we can't find a matching visit in our records, and we welcome contact to verify." The approach is in how to respond to a negative review.

4. Report to Google with the most precise reason. Steps in reporting a policy-violating review.

5. Watch the pattern. If waves recur from the same accounts, you have a broader case worth documenting systematically.

6. Consult a professional — only at this point. If there is explicit extortion or documented, repeated serious abuse, put your documented file in front of a licensed lawyer and let them decide whether a route exists.

FAQ

Can I sue a customer over an honest negative review?

Honest criticism of a service is a customer's right to begin with. Moving from "a painful review" to "an actionable matter" is a legal characterisation the business owner does not get to make. Consult a specialist before any step.

How do I find out who wrote the review?

You cannot, through Google. Any disclosure route runs through the competent authorities and is not available to business owners.

Someone is demanding money to delete their review — what do I do?

Do not pay. Document the message in full (screenshot including the account and date), report it to Google, and put the documentation in front of a specialist. Google itself announced protections in 2026 aimed specifically at this pattern.

Is reporting alone enough, without anything else?

In most cases yes, and it is the better path. The legal route is an exception reserved for serious, documented situations.

The bottom line

The law exists and it does address defamation — but it is a heavy, slow instrument, and it applies to you as readily as it applies for you. In sound day-to-day practice, the overwhelming majority of cases resolve with three steps: quick documentation, a polite public reply, and a precise report to Google.

And the part that actually consumes your time is not the exceptional cases — it is the daily monitoring and replying to every review that arrives. Raddly pulls your Google reviews into one place and drafts replies that keep your business's voice, so your reputation is managed routinely rather than only during a crisis.