We develop and test a model in which firms can make \textit{non-verifiable} statements about their CSR engagement, and hence may have incentives to mislead markets with exaggerated CSR claims. Firms may privately receive a signal correlated with their CSR engagement - e.g. a measure of greenhouse gas emissions - and have discretion over whether to publicly disclose it. Based on whether a signal is disclosed to them, and on what the signal is, markets form beliefs about the firm's CSR activities and the truthfulness of its claims. The model illustrates the disciplining effect of \textit{ex post} private signal availability on firms' \textit{ex ante} reporting on their CSR engagement. We test the model using a difference-in-differences approach that exploits special features of the introduction of the UK Companies Act of 2013, and find evidence supporting the model's predictions.