Law firm reviews and the bar association rules nobody mentions

In 2013, a Chicago employment lawyer named Betty Tsamis got a negative Avvo review from a former client whose unemployment-benefits claim she’d handled. Her reply disclosed why he’d been fired from his airline job. The review was arguably unfair. The reply was a confidentiality breach, and in 2014 the Illinois Attorney Registration and Disciplinary Commission reprimanded her for it. The one-star review cost her nothing measurable. The response cost her a permanent disciplinary record that any prospective client can find today.

That’s the structural trap of law firm reputation management, and it’s why generic review-response advice is actively dangerous for attorneys: a lawyer’s public reply to a review is regulated speech twice over - once by the duty of confidentiality, once by the advertising rules - and the self-defense exception most lawyers assume they have does not apply to online reviews.

One thing before anything else: this article is general information about the rules of professional conduct, not legal advice and not ethics advice. Your state’s rules control, they vary, and your bar’s ethics hotline will answer this exact question for free. Use it.

Rule 1.6 is much bigger than lawyers remember

ABA Model Rule 1.6 protects “information relating to the representation of a client.” Not privileged information - all information relating to the representation, from any source, including information that’s publicly available and including the bare fact that the person was your client at all.

Sit with that last clause, because it’s the one that breaks every instinct a business owner has. When a former client posts “this lawyer botched my custody case,” the natural opening - “we’re sorry your case didn’t go the way you hoped” - is already a disclosure. It confirms the representation. So does “our records show we returned every call.” So does correcting a single fact about the matter, even a fact the reviewer got wrong, even a fact that’s in a public court file. The client put the case on the internet; that does not release you. Confidentiality belongs to the client and survives the client’s own decision to trash you publicly.

The self-defense exception you think you have

Lawyers who half-remember Rule 1.6(b)(5) - the exception allowing disclosure to respond to allegations in a “controversy” or “proceeding” - tend to assume it covers a brutal Google review. The ABA answered this directly in Formal Opinion 496 (2021): a negative online review is not a controversy or proceeding within the meaning of the exception. No disciplinary complaint, no malpractice claim, no fee dispute in a tribunal - no exception. You may not disclose confidential information to respond to online criticism, full stop, even to correct outright falsehoods.

What Opinion 496 says you can do is a short and humbling list:

• Not respond at all (the opinion’s actual first recommendation - reviews often age into obscurity faster when nobody feeds them).
• Request the platform remove the post, if it violates the platform’s own policies.
• Contact the reviewer privately and try to resolve it, or ask a satisfied former client to post (their own, un-induced) perspective.
• Respond publicly without confirming or denying any representation, including a statement that professional obligations prevent a fuller answer.
• If the poster was never a client at all - and reviewers who were opposing parties, or who confused you with another firm, are common - you may say that, because Rule 1.6 protects clients, not strangers.

That last point is the one genuinely useful weapon in the kit. A meaningful share of law firm one-stars come from the other side of a case: the opposing party in a divorce, the debtor your client sued, the family member cut out of the will. “This reviewer has never been a client of this firm” is accurate, allowed, and tells prospective clients everything they need. (Use it carefully where saying so would effectively identify your actual client’s matter - the line can be thinner than it looks, which is hotline territory.)

The second layer: your response is attorney advertising

Rule 7.1 prohibits false or misleading communications about a lawyer’s services, and a public response to a review is a communication about your services. The response that brags - “we’ve won hundreds of cases like this”, “no firm in the county gets better outcomes” - has walked out of the confidentiality minefield and into the advertising one. Unverifiable comparative claims and results-promising language draw discipline on their own, no confidentiality breach required. Several states fold review responses into the same regime that governs your website copy; Florida’s Rule 4-7 series, the most prescriptive advertising framework in the country, is the standard cautionary example for firms marketing across state lines.

Three state postures worth knowing

The Model Rules are a template; states diverge. Three illustrative positions (verify your own state’s - this is exactly where general articles get lawyers in trouble):

California - the strictest confidentiality baseline. Business & Professions Code § 6068(e)(1) requires an attorney to preserve client confidences “at every peril to himself or herself,” and California never adopted a broad self-defense-style carve-out that would reach online criticism. The Los Angeles County Bar’s Formal Opinion 525 (2012) sketched the permissible response: proportionate, restrained, and disclosing nothing confidential. In practice, California lawyers have the least room in the country.

Colorado - the discipline precedent. In People v. Underhill (2015), a Colorado lawyer responded to former clients’ online complaints with internet postings that disclosed their confidential information, among other conduct, and was suspended. It remains the cleanest example of review-response conduct contributing to a suspension rather than a slap.

Texas - the “proportional response” formulation. Texas Professional Ethics Committee Opinion 662 (2016) concluded a lawyer may post a “proportional and restrained” reply to a negative review but may not reveal confidential information in doing so. New York’s bar reached substantially the same place in NYSBA Opinion 1032 (2014). The recurring vocabulary across states - proportional, restrained, no confidences - is effectively a national consensus with local footnotes.

What a compliant response actually looks like

Calloway & Reyes, a two-partner family law firm in Boise, gets this one-star from a former client:

“Paid this firm $9,000 and lost everything. Maria Reyes barely returned my calls and showed up to my custody hearing unprepared. Hire literally anyone else.”

The response a non-lawyer business would write - and that violates Rule 1.6 about four times:

“We’re sorry you’re unhappy, but this isn’t accurate. We secured you the exact parenting schedule you told us you wanted at intake, our file shows 31 documented calls and emails, and the fee reflected two contested hearings. We wish you the best.”

Confirms representation, discloses the matter type, discloses client communications, discloses fee arrangement. Every sentence is a separate problem, and it’s now screenshot-permanent. The compliant version:

“Our professional obligations, including the duty of confidentiality, don’t permit us to discuss any individual or whether any individual was a client - even when an online post describes a matter in a way we’d dispute. What we can say: our firm tracks every client call for return within one business day, and we review preparation for every contested hearing with a second attorney. Anyone with a concern about a matter is welcome to contact our managing partner directly at (208) 555-0149. - Calloway & Reyes”

Notice what it does. It explains the silence - without that first sentence, restraint reads as guilt to a prospect. It states firm policy in the abstract, which is the only register Rule 1.6 leaves open (the same generalize-don’t-confirm move that dental practices use under HIPAA - the regulated verticals all converge on this shape). And it offers a private channel with a named human. Six weeks after Calloway & Reyes standardized on this structure, their consult coordinator started hearing a new phrase in intake calls: “I liked that you didn’t argue with people online.” Eleven of their next 40 signed engagements came through profiles carrying that one-star, un-deleted, answered exactly once.

Which is the counterintuitive part most legal marketing misses: for a lawyer, the constraint is the message. Discretion is literally the product. A prospective divorce client reading a lawyer’s detailed public rebuttal of a former client’s review learns one thing - this is what the lawyer might someday write about me. The firm that visibly declines to relitigate is running an advertisement for confidentiality that no ad budget can buy.

Positive reviews are not the safe zone you think

Two traps hide on the sunny side of the profile. First, the grateful reply that breaches confidentiality: a client writes “got my charges dismissed, can’t thank this firm enough,” and the firm responds “so glad we could get that DUI resolved for you!” The client disclosed their own matter, which they’re free to do; the firm just confirmed the representation and added a detail, which it isn’t. The safe register for positive responses is gratitude without confirmation: “Thank you for the generous words - reviews like this mean a great deal to our team.” Bland on purpose. Bland is compliant.

Second, the incentivized-review program your marketing vendor keeps pitching. Model Rule 7.2(b) generally prohibits giving anything of value to a person for recommending the lawyer’s services, and a five-star review is hard to characterize as anything other than a recommendation. The $25 coffee card that a med spa can (carefully, with disclosure) consider is, for a law firm, a potential ethics problem stacked on top of the platform-policy and FTC problems everyone else has. Ask for reviews honestly, at the natural end of a matter, with nothing attached - that part is fine nearly everywhere - and leave the gift cards to the restaurants.

Build the response process like a conflicts check

Operationally, the rules dictate the workflow:

• Non-lawyer staff never respond freehand. The office manager who answers reviews at a dental practice is a feature; at a law firm she’s a Rule 5.3 supervision problem waiting to publish. Responses come from pre-approved language, reviewed by a partner once, reused thereafter.
• Run the was-this-a-client check first. It determines which of exactly two skeletons applies: the never-a-client response or the cannot-confirm response. If you want vetted starting language for both, replysmith.net maintains a law-firm template set drafted against the Model Rules framework, plus a general set for factually unfair reviews. Treat any template as a draft for your jurisdiction’s review, not finished work.
• Wait before posting. The general case for a cool-down is laid out in the negative review playbook; for lawyers it’s doubled, because your worst instinct - advocacy - is the exact instinct the rules prohibit.
• Document everything. Screenshot the review, log the response, note the date. If the review is defamatory enough to consider actual litigation, that record is where the analysis starts - though the math on suing a reviewer is sobering, and courts protect opinion vigorously. A 2024 Ohio appeals decision did allow a law firm’s defamation claims over a coordinated batch of 60-plus reviews to proceed, but coordinated, provably false campaigns are the narrow exception, not the playbook.

The part nobody tells you

The disciplinary complaint usually doesn’t come from the reviewer. The reviewer got what they wanted - they vented, you bled. It comes from a third party: opposing counsel who screenshots your response, a bar examiner doing a routine sweep, another lawyer in town with a grudge and a free afternoon. Online responses are the rare ethics violation that is public, permanent, timestamped, and self-authenticating. There is no he-said-she-said about a Google reply. You published the evidence yourself, under your bar number.

So the bar for posting anything is simple: assume your response will be read aloud, slowly, at a disciplinary hearing, by someone who does not like you. If it survives that reading, post it. Most drafts don’t - which is the system working.