Collecting testimonials with consent: the form, the record and the removal

Why a favour isn't enough

A kind email from a client isn't permission to put their name on your homepage. People say generous things privately that they wouldn't sign publicly, and some can't be named at all because of their employer or their own privacy. A quote lifted from an email, a review site or a social post without asking can embarrass the person, and in many countries consumer rules treat invented or misleading reviews as unfair trading. The simple fix is to separate the compliment from the consent, and get both in writing.

What the consent form should ask

Keep the testimonial consent form short enough to finish on a phone, but complete enough that you never have to guess later.

1. Their words, in a free-text box, with a prompt that gets specifics: what they needed, what you did, what changed afterwards.
2. How they want to be credited: full name, first name and initial, role and company, or anonymous.
3. Where you may use it: your website only, or also social posts and printed material. Ask as separate choices, not one blanket yes.
4. Whether you may shorten it, and that you'll never change its meaning.
5. Their email, so you can send the final version and they can ask for removal.
6. A plain consent statement they confirm, with the date recorded.

Anticode's built-in contact form asks only for a name, email and message, so it can't carry those choices on its own. A form with these fields is a custom form tied to a site function, which accepts up to 30 plain-text fields and shows your own thank-you message when it's sent. Forms can't take file uploads, so if you'd like a photo, ask for it by email after they've agreed.

The process, in order

1. Pick the moment. Ask when the result is fresh: the week a project ships, after a third class, when a client says thank you unprompted. Not with the invoice.
2. Ask personally, with the link. A short note from you, saying why you're asking and that no is a fine answer, then the form's address.
3. Receive it. Submissions are saved and sealed at rest, and can be emailed to you or sent to a connector. A Google Sheet, Airtable base or Notion database makes a good consent register: one row per testimonial, with the date and the choices made.
4. Edit lightly, then confirm. Trim for length if they agreed, fix typing errors, and email them the exact text and credit line you'll publish. Publish only after they reply yes.
5. Publish from a CMS collection. Keep testimonials as entries in a collection with fields for the quote, the credit line, the date approved and where it may appear. Anyone with access edits them in the dashboard without touching the layout.
6. Review once a year. Old testimonials about services you've changed mislead. Retire them, or ask the person whether it still stands.

Removal on request

Promise removal up front and do it quickly. When someone asks, delete the CMS entry, publish, and note the date in your register. Check anywhere else you used it: social posts, slide decks, printed leaflets you're still handing out. A testimonial removed from the website but still on a banner in reception hasn't really been withdrawn.

Mistakes to avoid

• Writing one yourself, or asking AI for "sample testimonials" to fill the page. Leave the section out until you have real ones. A page with no quotes is honest; a page with made-up quotes isn't.
• Paying or discounting in exchange without saying so. If you offered something for the review, many rules expect that to be disclosed.
• Keeping only the five-star ones in a way that misleads. Choosing your best quotes is normal; implying they represent every customer isn't.
• Stock photos beside real names. Use their photo with permission, or none.

How you know it's working

For every quote on the site you can open the register and find who said it, when they approved the final wording, and where they let you use it. Removal requests are handled within days, not months. And the quotes say something specific enough that a prospective customer recognises their own situation.

Limits

Anticode stores the submissions, sends them to your register through a connector, and publishes approved quotes from a CMS collection. It doesn't send the request or the confirmation emails, track consent expiry, pull reviews from Google or other review sites, or embed review widgets, since published pages can't embed outside content. It isn't legal advice on what your local rules require. See also the guide to collecting testimonials, CMS collections and site functions.

Questions people ask

Can I use a compliment from a client's email as a testimonial?

Ask first. Send them the exact words and credit line you'd like to use and publish only after they agree in writing.

Can I edit a testimonial?

Shorten or correct typing errors only if they agreed, never change the meaning, and send them the final version to approve.

What if someone wants their testimonial removed?

Remove the entry, republish, update your register, and check other places you used it. Promise this on the form so it's expected.