Negative Google Reviews in the UAE: The Law for Reviewers and Businesses

Online, the main provision is Article 43 of Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes, in force since 2 January 2022. It applies to anyone who uses an information network, IT equipment or an information system to insult another person, or to attribute to them a quality that would make them subject to punishment or contempt by others. The penalty on conviction is imprisonment and/or a fine of AED 250,000 to AED 500,000. Where the words target a public official or a person entrusted with a public service, during or because of their work, the law treats that as an aggravating circumstance.

The Penal Code, formally the Crimes and Penalties Law issued by Federal Decree-Law No. 31 of 2021, covers the same ground for statements made through any means of publicity, which its Article 10 defines to include writings and pictures distributed or circulated without discrimination by any means. Article 425 deals with attributing a specific incident to someone; Article 426 deals with insult that attributes no particular incident. One translation point causes confusion: the official English text calls Article 425 (qadhf in Arabic) libel and Article 426 (sabb) slander, the reverse of how most English speakers use those words. This guide uses the article numbers to stay clear of the trap.

The Cybercrime Decree-Law also protects private and family life (Article 44), punishes accounts falsely attributed to a real person or a company (Article 11) and covers threats made to force someone to act (Article 42); the table below gives the penalties. By contrast, Article 52 on rumours and false news concerns harm to the public, such as to public order or the national economy, not a private dispute between a customer and a business. For the wider picture, including oral insult, see the guide to defamation in UAE law.

The table sets out what different kinds of review content risk under the current texts. Where both the Cybercrime Decree-Law and the Penal Code appear, both are in force. Which provision is used for a particular post is a matter for the prosecution and the court, and Article 72 of the Decree-Law preserves any more severe penalty in the Penal Code or another law.

Article 428 says there is no crime where the person proves the incident they attributed, but only where it was attributed to a public servant or a person entrusted with a public service and the incident is connected with the job or service. Even then, proof is not allowed once more than five years have passed since the incident. A private business, its owner and its staff fall outside that defence.

The privacy provisions go further. Article 431 of the Penal Code applies to publishing news, photos or comments about the secrets of someone's private or family life even if they are true. Article 44(3) of the Cybercrime Decree-Law covers publishing news, photos, data or information about a person, even if true and genuine, with the intention of harming them. A review that reveals a staff member's personal circumstances is risky however accurate it is.

Two narrow defences exist. Article 429 protects what litigants say in their oral or written defence before courts or investigating authorities, within the limits of that right. Article 430 says there is no crime where a person informs the judicial or administrative authorities in good faith of an act that makes its perpetrator legally liable. A customer who believes a business has broken the law is therefore on firmer ground reporting it to the authorities than accusing it in a public review. The full analysis is in the guide to whether truth is a defence to defamation in the UAE.

None of this removes the risk entirely, because truth is not a general defence. It does keep a review away from what the offences are about, and within Google's own content policy, which allows reviews that describe a negative experience respectfully.

A criminal action for insult and slander of people can be started only on a complaint by the victim, their representative or an attorney holding a special power of attorney, under Article 11 of Federal Decree-Law No. 38 of 2022, the Criminal Procedures Law. Article 12 says the complaint is filed with the Public Prosecution or a judicial police officer. Article 11 names insult and slander of people without naming a statute, so it is not settled whether this complaint rule also governs the online offence in Article 43 of the Cybercrime Decree-Law. Either way, a message or a letter from the business is not itself a criminal case.

Your review is yours to change. You can edit it to remove insults, accusations or personal details, or delete it. Whether to do either, and what to say to the business, is a decision to take with your lawyer, because a careless reply can create a new problem of its own.

The law also recognises ways to end a dispute. Under Article 17 of the Criminal Procedures Law, the complainant may withdraw the complaint at any time before a final judgment, which ends the action. Under Article 68 of the Cybercrime Decree-Law, the accused may rely on an amicable settlement with the victim before the Public Prosecution or the court, for offences that include Articles 43 and 44, until the judgment becomes final. A settlement can include taking the review down or correcting it. Meanwhile, do not post about the dispute on other platforms or name the owner or staff elsewhere: each new post is a new publication.

This is a newspaper report of a ruling, not a citable precedent: it gives the court and the amounts but no case number. Two details matter. The headline said the man was fined, but the article describes civil compensation awarded to the company. And the civil award followed a criminal conviction, with the court awarding a third of what the company had claimed.

Two other Al Ain reports about posts concerning businesses follow the same pattern, both from the Al Ain Court for Civil, Commercial and Administrative Claims and both after a criminal conviction. As reported by Gulf News (last updated 23 May 2025), it awarded AED 70,000, against AED 200,000 claimed, over social media comments about a shop. As reported by Gulf News (last updated 28 December 2025), it awarded AED 100,000, against AED 200,000 claimed, against a business and its employees over a Snapchat video, and ordered an apology and a clear denial on the same account.

Across these reports, the civil claim followed a criminal conviction and the award was well below the amount claimed. For how compensation is assessed under the new Civil Transactions Law, see the guide to UAE social media defamation compensation.

Google's help page on reporting reviews says that only reviews that violate its policies are eligible for removal, and asks businesses not to report a review just because they disagree with it or dislike it. Its content policy for Maps allows reviews that describe negative experiences respectfully, and says merchants may not discourage or prohibit negative reviews. An honest critical review is not removable on request. The same policy bars fake engagement, so a business that buys or writes positive reviews breaks the rules it might invoke against a fake negative one.

What the policy does cover includes fake engagement and rating manipulation, content based on a conflict of interest (Google gives current or former employment, industry competitors and family relationships as examples), impersonation, harassment, hate speech, offensive content, personal information, obscenity and profanity, and off-topic content. Google's help page also links to a separate report for extortion involving negative reviews.

The report is made from the Business Profile: open the profile, select Read reviews, select Report next to the review, choose the reason and select Send report. Google's Reviews Management Tool shows whether a report is still pending, has been reviewed with no policy violation found, or has been escalated, and it allows a one-time appeal against a no-violation decision.

Under UAE law, a business cannot itself order a platform to take anything down. Federal Decree-Law No. 34 of 2021 gives that power to the competent authorities, which it defines as the federal or local authorities concerned with electronic and cyber security, and under Article 66(2) the Attorney General may order blocking. On conviction, Article 59 lets the court order the violating site closed or blocked, completely or partially. An access-blocking order disables access in the UAE only, so the content stays online elsewhere.

Classify the review before you act on it, because the response that fits one kind of review can make another worse. Whatever the row, keep the public reply calm: a reply that insults the reviewer, or reveals their booking details or other personal data, can itself fall under Articles 43 and 44 of the Cybercrime Decree-Law. If a review is part of a demand for payment, treat it as blackmail and follow the guide to online blackmail in the UAE.

Work through these steps in order. They keep the evidence intact and every option open.

Time matters for the complaint. Article 11 of the Criminal Procedures Law says a complaint for the listed offences, which include insult and slander of people, is not admitted after three months from the date the victim becomes aware of the crime and of who committed it. As with the complaint rule itself, it is not settled whether that limit also governs the online offence in Article 43 of the Cybercrime Decree-Law, so take advice within three months of learning of the post and who made it rather than wait to find out.

The complaint is the victim's own act, made in person to the police or the Public Prosecution, or through a lawyer recorded in the Roll of Practicing Lawyers, whom the courts and the Public Prosecution require for legal representation (Article 6(2) of Federal Decree-Law No. 34 of 2022 regulating the legal profession). Article 10 of the same law closes criminal proceedings to licensed non-national lawyers, and a foreign agency cannot itself file or argue an onshore court or prosecution matter. Onshore courts sit in Arabic, with a sworn interpreter for anyone who does not speak it (Civil Procedure Code, Article 5(1)).

The civil route rests on Federal Decree-Law No. 25 of 2025, the Civil Transactions Law, which replaced the 1985 law on 1 June 2026. Article 246 obliges whoever causes harm to compensate for it; Article 254(1) counts an infringement of reputation as moral harm; and Article 256(2) lets the court, at the injured party's request, order a specific act related to the harmful act by way of compensation, so the remedy need not be money alone. Under Article 258 a claim is barred three years after the injured party learned of the damage and of the person responsible, with time running from the end of the criminal action where the claim arises from a crime that is still prosecutable, and an absolute limit of 15 years.

Article 253(2) allows compensation to be reduced or refused where the injured party contributed to or aggravated the harm, one more reason not to answer a review in kind. The new law also makes a principal liable for harm caused by a subordinate in the performance of their duty or because of it, so a business can be answerable for reviews its staff post about a competitor as part of their work. For reviews posted before 1 June 2026, ask your lawyer which civil law applies, as the transitional rule was not confirmed for this guide. The steps for both routes are in the guide on how to file a defamation case in Dubai.

For a business, RepuLex prepares and submits policy reports to Google, uses Google's legal-removal process where content is unlawful, builds a dated, hashed record of every URL that a UAE lawyer or the police can use, and audits which reviews are removable, by which route, and which are not. Anything that is a UAE legal act, such as a complaint or a claim, stays with you or with UAE counsel you instruct. RepuLex does not remove honest reviews, write reviews or reply under false names.

Its review work for businesses, described on online reputation management in Dubai, is charged at published fixed fees per URL, paid in advance and refunded in full for any URL not removed within its agreed timeline, provided the business supplies the documents and authority requested for that URL. For how the same approach applies across the Emirates, see online reputation management in the UAE.