The Irish position
The Advertising Standards Authority for Ireland's code applies to advertising in any medium, including a website — your homepage, service pages, Google Business Profile description and social posts are all advertising in its terms.
A testimonial must come from a real customer, and must describe something that customer actually experienced. If your industry has its own regulator on top of the ASAI code (health-adjacent services, legal services, financial services), check its rules too — they usually sit on top of, not instead of, the general ASAI position.
Claims must be capable of substantiation, which for a testimonial means being able to show the customer exists and the experience happened, if ever asked.
Before and after imagery
Before/after imagery is permitted for businesses where it's relevant (trades, aesthetics, home improvement) but carries a condition: it must not misrepresent where or by whom the work was done. Stock imagery presented as your own results is the failure mode.
Practically, that means keeping records — consent for use, the date, and who did the work. If you cannot produce that, do not publish the image.
What to do instead when you don't have testimonials yet
Where you don't have a testimonial you can stand over, aggregate Google review data is usually stronger anyway — it is verifiable, third-party, and carries a visible count and date.
Review recency now outweighs total volume in local ranking, so a live review feed does double duty: it satisfies the trust need on the page and feeds the signal that moves you up the map pack.
Questions
Can I use a Google review as a testimonial on my website?
A Google review from a genuine customer describing something they actually experienced meets the same test as any other testimonial. Displaying reviews with their source, date and author visible is generally the safer presentation because it is verifiable.
Do the rules apply to social media as well as my website?
Yes. The ASAI code applies to advertising in any medium, including social posts, paid ads and printed material — not only to your website.
What happens if a business breaches the code?
The ASAI can require an advertisement to be withdrawn or amended following a complaint. If your industry has its own regulator, it may be able to act separately too.