A negative Google review may be legitimate consumer criticism, but deliberately fabricated claims, organised review campaigns or threats against a business can expose those involved to criminal and civil liability under UAE law.
The warning comes after Dubai Police arrested a group accused of posting false and negative Google Maps reviews targeting a company in an attempt to damage its reputation and cause financial losses. Police said the investigation followed a complaint from the company and found that several commercial shops had allegedly formed groups to publish false reviews.
But where does the law draw the line between a genuine bad review and a criminal offence?
Stay up to date with the latest news. Follow KT on WhatsApp Channels.
According to judicial counsellor Hesham Elrafei, the main legislation applicable to such cases is the UAE's Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes. The specific offence and penalty depend on what was posted, how it was posted and whether the reviews were part of an organised or paid campaign.
In the Dubai case, police said the investigation found that those involved had posted comments about the company despite never having visited its premises. The company had complained after noticing a series of negative reviews that it said were affecting its business. Police then formed a team to investigate the accounts, identify the users behind them and take action, with the suspects referred to Public Prosecution.
A genuine complaint is not automatically illegal
Consumers can share negative experiences online, including complaints about poor service, late deliveries or unsatisfactory products.
The legal risk arises when a person moves beyond describing a genuine experience and starts fabricating incidents, making defamatory accusations, personally insulting others or deliberately organising false reviews to damage a business.
Elrafei said the distinction is important: a customer who genuinely received poor service can describe that experience, while someone who invents an incident or coordinates fake reviews to harm a company could face criminal consequences.
The distinction has also emerged in a recent Abu Dhabi case involving an online restaurant review. Earlier this year, an influencer was fined after a video was found to have defamed the restaurant rather than simply criticised its services. The case resulted in a Dh30,000 criminal fine, an order to remove the video and confiscation of the phone used to record and publish it, while the court also ordered Dh51,000 in temporary civil compensation. Lawyers told Khaleej Times at the time that criticism should remain focused on the product or service, rather than attacking an individual's character, integrity or personal life.
Defamatory reviews can lead to fines of up to Dh500,000
Article 43 of the Cybercrimes Law covers online defamation and insults.
Under the provision, using an information network or electronic information technology to insult another person or attribute a quality to them that could expose them to punishment or public contempt can result in imprisonment and/or a fine ranging from Dh250,000 to Dh500,000.
That means a review is not necessarily protected simply because it is presented as an online “opinion”. The substance of the statement and the circumstances in which it was published matter.
Paid fake-review campaigns carry a much heavier risk
One of the more serious provisions identified by Elrafei is Article 55.
The article criminalises requesting, accepting or receiving, or being promised a material or non-material benefit in return for publishing or republishing illegal content or false data using electronic information technology.
The penalty is temporary imprisonment and a fine of up to Dh2 million, with the law also providing for forfeiture of the benefit obtained.
For fake-review cases, this could become particularly significant where investigators can establish that people were paid, promised payment or otherwise offered a benefit to publish unlawful or false content.
Elrafei stressed that the payment or promised benefit must be proved for this provision to apply.
What if bots are used?
The law also specifically addresses the use of electronic robots to spread false information.
Article 54 states that anyone who creates or modifies an electronic robot with the intention of disseminating, redistributing or circulating false data or news in the UAE, or enabling others to do so, can face up to two years in prison and/or a fine of between Dh100,000 and Dh1 million. The punishment can be increased where there are multiple offenders.
This means that an automated campaign involving fake accounts or bots could create a different legal exposure from a person simply posting a single review.
What does cyber-extortion entail?
There is another potential scenario that businesses and consumers should be aware of — using online threats to force someone to act or refrain from acting.
Article 42 of the Cybercrimes Law covers cyber-extortion and cyberthreats. It provides for imprisonment of up to two years and/or a fine of between Dh250,000 and Dh500,000 where an information network or electronic information technology is used to extort or threaten another person to force them to act or refrain from acting.
According to Elrafei, this provision could become relevant where someone threatens a business with damaging reviews unless the business provides money or another benefit.
Competitors face another layer of liability
The issue is not limited to criminal cybercrime provisions.
Article 63 of the UAE Commercial Transactions Law states that a merchant may not use fraudulent or deceptive methods to market goods or publish false particulars prejudicial to the interests of another competing merchant. A violation can make the merchant liable for compensation.
This could be particularly relevant where competing businesses are behind a campaign designed to undermine another company's reputation.
The consequences can also extend beyond a fine. In a recent UAE case involving allegedly defamatory online content, the court ordered the offending material to be removed and confiscated the device used to record and publish it, alongside the criminal fine and civil compensation. The case illustrates that online content can have consequences beyond the original post, particularly where a court finds that it caused legally recognised harm.
Businesses can also seek compensation
Criminal liability is not necessarily the end of the matter.
Elrafei said businesses can pursue compensation for proven financial losses caused by unlawful reviews, but they would need to establish both the damage and its connection to the unlawful conduct.
That could make evidence critical in any dispute, including the content of the reviews, evidence showing who posted them, communications surrounding an organised campaign and proof of the financial impact on the business.
Can a customer post a bad review?
Yes, a customer can describe a genuine negative experience.
The legal risk comes when a review is fabricated, defamatory, insulting, part of a coordinated campaign, generated through prohibited means, or used as part of a threat or extortion attempt.
The Dubai Police case highlights why the distinction matters. Police have warned that online platforms cannot be used to deliberately harm others, while UAE law provides several different routes for authorities or affected businesses to pursue conduct depending on its nature.
For businesses, the case also highlights the importance of documenting suspicious review activity and any resulting financial damage rather than simply treating a sudden wave of negative reviews as a routine customer-service problem.
What should businesses do?
For businesses facing a suspected fake-review campaign, the legal experts' advice points to preserving evidence rather than simply deleting or ignoring the reviews. Screenshots, account details, messages, dates and evidence of any financial impact can help establish what was posted, who was behind it and whether the conduct caused measurable damage. The Dubai Police case also shows that businesses can report suspected coordinated activity to authorities, who may investigate the accounts behind the posts.