How to Respond to a Google Review That Shares Private Information

The review is one star, and that's the least of your problems. It names your front-desk employee, first and last name, describes which shifts she works, and ends with her personal phone number and a suggestion that people "let her know what you think."

Or maybe it's your own cell number posted for the world. Or a photo of another customer who never agreed to be in anyone's review.

Most bad reviews damage your rating. This one damages a person, and it keeps doing damage every hour it stays up. That changes the playbook: the order you act in, what your reply can safely say, and how hard you push for removal. Here's the whole sequence.

Quick Answer: Flag the review immediately through your Business Profile, because Google's content policy prohibits posting other people's personal or confidential information and these reviews have a strong removal record. Then post a short public reply that acknowledges the feedback without repeating a single private detail, and offer a direct contact channel. Never quote the name, number, or detail in your response. For the full framework, see our complete guide to responding to Google reviews.

In this guide, you'll learn:

• Why a privacy-violating review is the rare case where you flag before you reply
• What Google's personal information policy actually covers, and how to report under it
• Reply templates that address the review without amplifying what it exposed
• How to protect an employee who was named, and the confidentiality trap for medical, legal, and financial businesses

Why This Review Is a Different Kind of Emergency

With an ordinary negative review, the harm is reputational and it accrues slowly. A reader sees it, weighs it against your other reviews, moves on.

A review that publishes someone's personal information works differently. The harm is in the content itself, and it compounds. Every view is another person who now has your employee's full name and number. Google's pages get indexed, quoted, and screenshotted, so the information can outlive the review.

That's why the usual advice for negative reviews, respond thoughtfully within a day or two, is too slow here. You're not managing an opinion. You're containing a leak.

It also means your usual instincts can backfire. A detailed public reply that references what was posted makes the problem more visible, not less. The goal of everything you do next is the opposite: get the information down, and add nothing to it while you wait.

Flag First: This One Skips the Line

For most difficult reviews, we recommend replying first and flagging second, because flags are slow and readers see silence in the meantime. This scenario flips that order.

Google's content policy prohibits distributing or posting other people's personal or confidential information. Phone numbers, home addresses, and identifying details about private individuals all qualify. Unlike a he-said-she-said dispute about service, a moderator can see this violation in the review text itself, which is why these flags tend to succeed.

Report it right away. Find the review in your Business Profile, choose Report review, and select the option covering personal information or privacy. Do this before you write anything public.

Screenshot it first. Capture the review before it changes or disappears. If the named person later needs a record, for HR, for a platform appeal, or for the police, you'll want the original.

Escalate if the first flag stalls. Give it a few days, then appeal through Google's review management tool with a short, factual note pointing at the specific detail that violates policy. Our guide to getting a Google review removed covers the escalation path step by step.

If there's a threat, treat it as one. A review that pairs someone's personal details with hostility or an invitation to harass them is beyond reputation management. Save everything and consider involving local police.

The One Rule for Your Reply: Repeat Nothing

While the flag works through Google's queue, a short public reply still earns its keep. It shows readers a composed owner, and it gives the reviewer a private path if there's a real complaint underneath. But this reply has one rule that outranks every other: do not repeat what they posted.

Not the employee's name. Not a correction of the phone number. Not "we've reported this review for posting Maria's address." Your reply is permanent in a way the review may not be: if Google removes the review, replies vanish with it, but screenshots of your reply circulate on their own, and until removal happens your reply sits right there amplifying whatever it references.

There's a second trap for businesses bound by confidentiality. If you run a medical practice, law office, counseling service, or financial firm, and the reviewer revealed their own diagnosis, case, or account details, you cannot confirm they were ever a patient or client. They can share their information freely; the moment your reply says "we're sorry your treatment didn't meet expectations," you've disclosed a relationship you're obligated to protect. This is the same discipline we cover in our healthcare review response guide: reply to the feedback, never to the relationship.

Reply Templates That Add Nothing

The tone target is calm and brief, with the substance handled off-Google. Adapt these to your voice.

The review that names and targets an employee

"Thank you for the feedback. We take reviews seriously, but this one shares personal details about a member of our team, so we won't discuss it publicly. If you'd like to talk through what happened, please reach us directly at [email/phone] and we'll listen."

You've told readers exactly why your reply is short, without repeating a single detail.

The review that posts a phone number or address

"We appreciate honest feedback, but we don't think personal contact details belong in a public review, so we've asked Google to take a look. We'd genuinely like to resolve whatever went wrong. Please contact us at [email] and we'll make time for you."

Naming the problem in general terms is fine. Quoting or correcting the information is not.

The reviewer who shared their own sensitive details

"Thank you for taking the time to write. We can't discuss individual situations in a public forum, but we'd welcome the chance to talk directly. Please reach out at [phone/email] so we can help."

Notice there's no confirmation that they were ever a customer, patient, or client. For confidentiality-bound businesses, that's the whole game.

Not sure how to word yours? Try our free AI response generator. Paste the review and get a calm, professional draft you can fine-tune before posting. No signup required.

Protecting the Person Who Was Named

If the review exposed an employee, the review response is only half the job. The other half is standing between that person and the internet.

Tell them before they stumble onto it. Hearing "there's a review naming you, and we've already reported it" from you lands very differently than finding it alone at 11 p.m.

Ask them not to respond from a personal account. An employee defending themselves in the review thread or over DM almost always escalates things, and it hands the reviewer a fresh target. The business replies; the person stays out of it.

Check the other platforms. Someone angry enough to post a name and number on Google often posts the same thing on Yelp or Facebook, and each platform has its own privacy reporting path.

Handled well, this becomes a strange kind of loyalty moment. Teams remember the owner who moved fast when one of them was exposed, the same way they remember the one who shrugged. It's the same principle behind responding to reviews that attack an employee: the public sees composure, and your team sees protection.

Frequently Asked Questions

Will Google remove a review that contains personal information?

Usually, yes. Google's content policy explicitly prohibits posting other people's personal or confidential information, including phone numbers, addresses, and full names paired with identifying details. Report the review through your Business Profile and select the option for personal information. These flags have one of the better removal rates because the violation is visible in the review text itself.

Should I mention the private details in my public reply?

Never. Repeating a name, number, or detail in your reply amplifies it, and your reply stays up even if Google removes the review. Keep the response generic: acknowledge the feedback, note that the review shares personal details you won't repeat publicly, and move the conversation to a private channel.

What if the complaint itself is legitimate but the review includes private information?

Treat them as two separate problems. Flag the review for the privacy violation, and address the underlying complaint privately with the customer regardless of what happens to the review. If Google removes it, the customer may repost without the private details, and a fair, composed reply to that version protects you far better.

What if the reviewer shares their own private details, like health or financial information?

Their own information is theirs to share, so Google likely won't remove it. Your risk is in the reply. If your business is bound by confidentiality, like healthcare, legal, counseling, or financial services, do not confirm they were ever a patient or client. Thank them for the feedback in general terms and invite them to contact you directly, without referencing anything they revealed.

What should I do for an employee who was named in a review?

Tell them before they find it on their own, and make clear the business is handling it. Ask them not to reply from a personal account, since that usually escalates things. Flag the review, document a screenshot, and check other platforms in case the reviewer posted the same thing elsewhere. If the review includes threats, save everything and consider a police report.

The Bottom Line

A review that publishes private information isn't really a review problem. It's a containment problem wearing a review's clothes, and the clock matters more than the wording.

Flag it the moment you see it, because Google's policy is clearly on your side. Reply briefly without repeating one syllable of what was exposed. If you're bound by confidentiality, don't confirm the relationship at all. And if the review named one of your people, make sure the first thing they hear is that you're already on it.

Key Takeaways:

• Google prohibits reviews that post other people's personal or confidential information, so flag immediately; this is the rare case where the flag comes before the reply.
• Never repeat, confirm, or correct the exposed detail in your response; a generic reply plus a private contact channel is the entire move.
• Confidentiality-bound businesses must not confirm the reviewer was ever a patient or client, even when the reviewer shares their own details.
• Screenshot the review before it changes, and escalate through Google's review management tool if the first flag stalls.
• Protect a named employee directly: tell them first, keep them out of the thread, and check other platforms for reposts.

For the broader framework, see our complete guide to responding to Google reviews. For neighboring situations, see responding to a defamatory review and our guide to Google's review policies.

---