Can therapists use client testimonials? What BACP, UKCP, and NCPS actually say
The received wisdom is that testimonials are banned. I went looking for the clause, read the codes end to end, and found something more complicated.
There’s a piece of received wisdom in the therapy world that goes like this: testimonials are banned, everyone knows it, don’t go near them.
I hear it on calls constantly, usually as a throwaway line rather than something anyone has checked. So I went looking for the clause. I had both versions of the BACP Ethical Framework read end to end, the 2018 one and the 2026 one that becomes mandatory at midday on 3 November 2026.
It isn’t there. Neither version contains a rule about testimonials, reviews, endorsements, or advertising as named topics.
That genuinely surprised me, so I went through the other bodies too. Here’s what each of them actually says, what the advertising rules and UK GDPR add on top, and what I’d do instead.
The usual caveat, and it matters more than usual here. I’m not part of the BACP, the UKCP, or any professional body, and I don’t speak for them. I’m a marketing consultant who has spent the past decade on therapists’ websites and SEO. Every clause below is quoted from the published code and linked, so you can check my reading against the source. For anything affecting your registration, ask your body’s ethics service, not me.
The short version: UKCP bans client testimonials outright. BACP, NCPS, BABCP, and HCPC don’t, and instead impose honesty and confidentiality duties that make most testimonials hard to use well. On top of that, the CAP Code and UK GDPR apply to everyone regardless of registration, and the GDPR problem is the bigger of the two. In practice, permitted and still usually a bad idea.
What BACP actually says
BACP’s framework works through commitments and duties rather than a list of prohibitions, which is why people assume the ban is buried somewhere.
The relevant clause in the 2026 version is 1.2(a), which asks members to “be honest about our work and provide clear, accurate information about services offered, our level of qualification, experience and our competence to undertake that work”. The 2018 framework says something similar, that “whenever we communicate our qualifications, professional experience and working methods, we will do so accurately and honestly”.
There’s also no Good Practice in Action resource dedicated to advertising or testimonials. The nearest relatives cover social media and digital technology, and GPiA 040 on social media doesn’t mention testimonials at all.
What that means in practice. BACP doesn’t ban testimonials. It imposes duties of honesty, accuracy, and confidentiality that make most testimonials difficult to use well, which is a different thing. If you can obtain one without breaching confidentiality or leaning on a client, the framework itself doesn’t stand in your way.
I’d add the obvious: “not banned” and “a good idea” are two very different findings, and the rest of this article is mostly about the gap between them. If you want the wider picture on what the 2026 framework changes, I covered it in my guide to AI and the new BACP Ethical Framework.
What UKCP says
UKCP is the outlier, and it’s unambiguous. Clause 13 of the Code of Ethics and Professional Practice 2019 requires members to:
“Not make any claims which you cannot demonstrate to be true or include testimonials from clients in any advertising.”
That’s a flat prohibition. Clause 19 adds a duty to “safeguard the welfare and anonymity of clients when any form of publication of clinical material is being considered”.
If you’re UKCP registered, the answer is no. Not with consent, not anonymised, not “a client once said”. No client testimonials in advertising, and your website is advertising.
What NCPS, BABCP, and HCPC say
NCPS doesn’t ban them. Its code requires advertising that “represents a truthful, honest and accurate picture”, and that any claim about successful outcomes rests on “verifiable, fully-documented evidence”. It then points members straight at the CAP Code and ASA guidance, which is where the real rules live for NCPS registrants.
BABCP’s Private Practice Guidelines say advertising must be accurate and never “misleading, false, unfair”, and specifically warn against using data to imply recovery or improvement rates that may not apply to your clients. No testimonial clause.
HCPC standard 9.3 requires you to “take reasonable steps to make sure that any promotional activities you are involved in are accurate and are not likely to mislead”, alongside standard 5.1 on confidentiality. Again, no testimonial clause.
So the picture is one outright ban and four bodies constraining testimonials heavily through honesty and confidentiality duties without prohibiting them.
The two rules that catch everyone out
Your professional body isn’t the only authority here, and these two apply to every practitioner regardless of registration.
The CAP Code
Anything on your website counts as marketing, so the CAP Code applies. Section 3 covers testimonials and endorsements, and the rules that bite are:
- 3.44: marketing communications must not contain fake consumer reviews.
- 3.45: where reviews have been incentivised, that must be made clear.
- 3.46: reviews must not be published misleadingly, which includes suppressing negative ones.
- 3.47: you must hold documentary evidence that a testimonial is genuine.
- 3.50: you must not feature a testimonial without permission.
That third one is worth sitting with. Publishing only your five-star feedback and quietly leaving out the rest is a breach, not a marketing tactic.
UK GDPR
This is the bigger risk, and the one I see handled worst.
The ICO defines data concerning health as personal data revealing “the provision of health care services”. A testimonial identifying someone as your client reveals that they received therapy, which makes it special category data. That needs explicit consent, expressly confirmed in words, not inferred from someone nodding at the end of a session.
The ICO is also clear that consent must be freely given and easy to withdraw, and that “freely given consent will also be more difficult to obtain in the context of a relationship where there is an imbalance of power”.
You don’t need me to spell out the therapeutic implications of asking a client for a favour. And “J, Ealing” is not anonymous in a town where you’re the only trauma specialist. If your privacy notice doesn’t currently cover any of this, that’s the place to start, and I’ve written a template and guide for exactly that.
What about a Google review you never asked for?
Different problem, same discomfort. A client leaves a public review, and you can’t even thank them without confirming they were a client.
Google does allow businesses to ask for reviews, and prohibits incentivising them, gating them, or pressuring people on the premises. But the live question is usually what to do about one that already exists.
Google will remove reviews that breach its content policies, including the rule against posting “medical information” or personal identification information about others. If a review exposes identifying details, you have a case. Report it through your Business Profile or the reviews management tool, and expect a few days for a decision.
One realistic caveat: Google has no therapy-specific or confidentiality-specific removal ground. A negative review that doesn’t breach policy stays, however awkward it is. The only safe response is a generic one that neither confirms nor denies a therapeutic relationship, thanking the reader for the feedback and pointing anyone with a concern towards your complaints procedure.
Worth doing: a short reviews policy on your site. It explains to visitors why you have few or no reviews, and gives you something to point at when a client asks.
What to do instead
None of this leaves you without options. Here’s what I recommend to practices, roughly in order of value.
Peer and supervisor endorsements. A quote from a supervisor, a training provider, or a GP who refers to you carries real weight and involves no client data at all. This is the most underused trust signal in the whole niche, and I almost never see it on a therapy site. It also costs nothing, unlike the directory subscriptions most practices are already paying for.
A properly set up Google Business Profile. Reviews are only one part of what Google calls prominence. Complete information, the right categories, and a strong website do most of the work, and if your listing isn’t appearing at all, these six causes are where I’d start. I covered the setup, including how to avoid publishing your home address, in this guide.
Visible credentials. Your professional body logo, membership number, qualifications with the year obtained, and a link to your entry on the register. This is the trust signal Google’s quality systems actually reward, and it’s the backbone of E-E-A-T.
Anonymised composite examples. Not a testimonial, but a description of the kind of work you do and what tends to shift, written by you and drawn from no single client. Useful for the reader, no consent issue, no confidentiality risk. This is exactly the kind of writing I argue for in blogging for therapists, where one considered post beats ten rushed ones.
A clear “what happens in the first session” page. Most people looking for a therapist aren’t comparing star ratings. They’re frightened of walking into a room and not knowing what to say. Answer that properly and you’ll do more for enquiries than twenty reviews would.
Ready to see what’s working on your site?
If you would like to know how your own blogs measure up on EEAT, and get clear recommendations you can act on, book a free 30-minute call with me. We’ll look at your site together and I’ll show you where the quick wins are.
Frequently asked questions
Does BACP ban client testimonials?
No. Neither the 2018 Ethical Framework nor the 2026 version taking effect on 3 November 2026 contains a clause on testimonials, reviews, or advertising as named topics. BACP imposes duties of honesty, accuracy, and confidentiality that make testimonials hard to use well, which isn’t the same as a prohibition.
Does UKCP ban client testimonials?
Yes. Clause 13 of the 2019 Code of Ethics and Professional Practice requires members not to “include testimonials from clients in any advertising”.
Can I use a testimonial if the client gives written consent?
If you’re UKCP registered, no. For other bodies, consent is necessary but not sufficient. You still need explicit GDPR consent for special category data, freedom from any power imbalance, and a way for the client to withdraw at any time.
Can I ask a former client for a Google review?
It isn’t prohibited by most UK codes, but it carries real risk. The therapeutic relationship doesn’t end cleanly at the last session, and the ICO’s power-imbalance point still applies. If you do, do it well after ending, never with an incentive, and record the consent in writing.
What if a client leaves a review that identifies them?
Report it to Google under the policy on personal and medical information. If Google declines, respond generically without confirming that the person was a client.
Is it worth having no reviews at all?
It’s not ideal, but it’s survivable, and it’s the norm in this profession. Review count is one input into prominence, not the whole of it. A strong website, complete listing, and visible credentials will carry you.
The bottom line
The blanket “testimonials are banned” line is wrong for most UK therapists and right for UKCP registrants. Ten minutes with your own code is worth more than another decade of repeating what everyone says.
For everyone else, the honest answer is that testimonials are permitted and still usually a bad idea, because the GDPR and confidentiality problems are real even where the ethics clause isn’t.
The trust signals that work in this niche are your credentials, your peers, and a website that answers the questions a nervous first-time client is actually asking. That’s the work, and it’s more durable than a star rating anyway.
One last reminder, because it matters: I’m a marketing consultant, not your professional body, your insurer, or your supervisor. Use this as a starting point, read your own code, and confirm anything registration-related directly with your body, especially as codes get revised.
Need help with the website side of this?
If the part nagging at you is how your site presents your credentials and trust signals, that’s the bit I can help with. I work exclusively with therapists, counsellors, and mental health professionals across the UK on website design and SEO, and trust pages are part of every build.
Book a free 30-minute consultation and I’ll look at your current setup and tell you honestly whether you need help or whether it’s a half-hour job you can do yourself. No pressure, no sales pitch.
Written by Theo Ruby, a digital marketing consultant with over 10 years of experience helping therapists and mental health professionals grow their practices online. Theo has worked with 300+ therapy professionals across the UK on website design, SEO, and digital marketing strategy. Theo is not affiliated with the BACP, UKCP, NCPS, BABCP, or HCPC. Every clause quoted here is linked to the published code and was checked in August 2026. This article is general guidance, not legal or ethical advice. Always confirm requirements directly with your professional body.
Get in touch: www.theoruby.com/contact