How to Handle a One-Star Google Review Without Breaching Client Privacy

28 August 2026·6 min read

Quick answer: The single biggest mistake professional services firms make when responding to a one-star Google review is revealing anything about the client or their matter — even indirectly — to defend the firm's side of the story, which can breach privacy or confidentiality obligations. The safe path is a short, generic, non-defensive public reply, paired with a private offer to discuss offline, and escalation to Google or a professional body only when the review contains false factual claims or breaches platform policy. 🤍

A one-star review lands and every instinct says defend yourself properly — explain what actually happened, correct the record, show future clients the full picture. 💖 That instinct is exactly what gets regulated professionals into trouble, because "explaining what actually happened" almost always means disclosing something about a specific client or patient's matter, even without naming them, and that can be enough to breach privacy or confidentiality obligations on its own.

What most firms get wrong

The most common error is thinking that not naming the client makes a response safe. It doesn't. If the review and the response together make the client identifiable to anyone who knows the context — the outcome of their case, the amount involved, the date, the specific issue — that can still be a disclosure. The second common error is responding emotionally and quickly, within the first hour of seeing the review, before anyone with authority to weigh privacy risk has reviewed the draft. The third is staying completely silent, which can look like an admission to anyone reading later, when a brief, careful, non-specific response would have looked far more professional.

Please note: general information, not legal/financial/medical advice — check current official guidance before relying on it.

Safe response template + decision tree

Safe public response template (adapt tone, don't add specifics):

"Thank you for sharing your feedback. We take all client/patient concerns seriously and would welcome the chance to discuss this directly — please contact us at [phone/email] so we can better understand your experience. We're not able to comment on individual matters publicly out of respect for client privacy."

Decision tree — before you respond, work through this in order:

Does the review name the client or make them identifiable? If yes, do not confirm or deny they are/were a client in your response, even implicitly.
Does the review contain false factual claims (wrong outcome, wrong dates, wrong service entirely)? If yes, consider a factual-error report to Google rather than a public rebuttal — this avoids the privacy risk of correcting the record yourself.
Does the review breach the platform's policy (defamatory, fake, posted by a non-client, harassment)? If yes, report it to Google directly and keep records; this can take time and isn't guaranteed to succeed, so don't rely on it as your only response.
Is the review a genuine but painful account of dissatisfaction? If yes, use the safe response template above, then follow up privately by phone or email, ideally within 24–48 hours.
Is there any chance the matter could become a formal complaint or dispute? If yes, loop in whoever manages professional indemnity or complaints processes before responding publicly at all.

Law firm responding to a client who lost their case: The temptation is to explain that the outcome was realistic given the facts, or that the client was advised of the risk. Both of those statements reference case-specific advice and outcome, which is exactly the kind of detail that should stay out of a public response — take it to the safe template and a private call instead.

Psychology practice responding to a client who felt misunderstood: Never confirm the person was a client, never reference session content, and never suggest a diagnosis or presentation influenced the experience — beyond the privacy issue, this sits squarely in AHPRA advertising and conduct territory. A warm, generic, non-identifying response paired with a genuine private invitation to talk is the safest and, frankly, most caring-looking option to anyone reading it later.

Accounting firm responding to a client unhappy about a tax outcome: Resist correcting the record with specifics like "we followed the ATO guidance available at the time" or "the client didn't provide records until late" — both are effectively disclosing details about their engagement. Use the template, then resolve the substance of the complaint privately and thoroughly.

How to prepare before this happens (because it will, eventually)

Write your safe response template before you need it, while nobody's upset and everyone can think clearly. Decide now who is authorised to respond to reviews and set a rule that no one responds within the first few hours of seeing a bad one — a short pause almost always improves the response. Keep a simple internal log of every review response for consistency and, if needed, for your own records if a complaint escalates later.

💡 The private follow-up matters more than the public reply. A calm, well-worded public response protects your professional obligations, but it's the private conversation — a genuine attempt to resolve the actual complaint — that occasionally turns a one-star review into a removed or updated one, though there's no guarantee of that outcome.

Mistakes to avoid

Confirming or implying someone was a client, even while trying to defend the firm
Referencing outcomes, advice given, fees, dates or any specific circumstance of the matter publicly
Responding within the first hour, before anyone senior has reviewed the draft
Assuming Google will quickly remove a review just because it's unfair — reporting is not guaranteed and can take time
Leaving a genuine, non-identifying complaint completely unanswered

Frequently asked questions

Can we ever explain our side of the story publicly?

Generally, no — not in specific terms. You can express general empathy and professionalism, and invite private discussion, but explaining "what actually happened" in a way that references the client's specific matter risks a privacy or confidentiality breach regardless of how justified the explanation feels.

What if the review is clearly fake or from someone who was never a client?

Report it to Google as a policy violation with any supporting evidence you have. This is one of the few situations where escalation, rather than a template response, is the right first move — though removal isn't guaranteed and the process can take time.

Should we ask happy clients to leave reviews to balance out a bad one?

Ongoing, genuine review requests as part of normal practice are fine and worth doing consistently. Suddenly soliciting a burst of reviews right after a bad one appears can look manipulative to both readers and Google's review systems, so keep review requests as a steady habit rather than a reactive scramble.

Does this apply the same way to a private practitioner and a large multi-partner firm?

The core privacy principle applies equally, but a larger firm should also have a documented escalation path so a junior team member never has to decide alone whether a response is safe — that's a real limit worth planning for regardless of firm size.

Keep reading 🤍

Written by

Kate, founder of Chronically Online

I help Gold Coast and Brisbane businesses grow with branding, websites and marketing that actually works.

Work with me ✦