Managing Online Reviews When You Cannot Discuss the Case

The review lands on a Tuesday morning. Two stars, a former matter, and a version of events that is wrong in three specific places you could prove in about ninety seconds from the file sitting open on your screen. You have the emails. You have the dated engagement letter. You have the invoice showing exactly what was billed and when. Every instinct built by years of advocacy says to answer the record with the record, and every one of those instincts is about to get you in trouble, because the file is the one thing you are not allowed to use.

This is a genuinely strange problem, and it is specific to regulated professions. A restaurant can reply that the customer ordered the fish well done. A contractor can post the signed change order. A law firm can do neither, and in most cases cannot even confirm that the person leaving the review was ever a client at all. The duty of confidentiality does not switch off because the client went public first, it does not expire when the matter closes, and in most jurisdictions it covers far more than privileged communications. It covers information relating to the representation, full stop, which includes the plain fact that a representation existed.

So the entire game changes shape. Reviews stop being a marketing problem that a communications person handles and become an operations problem that runs through intake, matter management, billing, and file discipline. This piece covers the two halves that actually matter: how to ask for reviews at a moment that is both ethical and likely to work, and how to respond to a bad one without confirming a representation, correcting a fact, or saying a single thing about the matter. Rules vary meaningfully by jurisdiction, so treat everything here as the mechanism and confirm the specifics with your own regulator before you publish anything.

The review is public but the file never becomes public with it

The most common error is treating a client's public post as a waiver. It is not. In the American Bar Association's Model Rules framework, the duty under Rule 1.6 belongs to the client and is waived by the client's informed consent, not by the client's decision to complain in public. A former client who writes four paragraphs about their divorce on a review site has disclosed their own information voluntarily, which is entirely their right, and has done nothing at all to release the lawyer from a separate professional duty owed to them. The obligation continues after the matter closes under the former-client rule, and it continues after the client dies.

The practical consequence is that the review and the file must be kept in different universes. The moment you open the matter to draft a reply, you are working with material you cannot use, and the risk is not that you will quote a document, it is that you will paraphrase one. "The timeline you describe is not what our records show" is a disclosure about the contents of the records. "We advised against that approach at the time" is a disclosure about the advice given. Neither quotes anything, both reveal something, and both are the kind of sentence a bar complaint gets built around. Confidentiality rules differ across the United States, England and Wales, Canada, and Australia, but on this particular point they land in broadly the same place, so the safe operating assumption is that nothing from the file goes into a public reply anywhere.

Confirming the person was a client is itself a disclosure

Firms tend to think of confidentiality as being about the contents of a matter. It also covers the existence of one. If a person leaves a review that does not name their case, and the firm replies with anything that acknowledges them as a client, the firm has just published the fact of representation to everyone who reads that page. In most practices that is uncomfortable. In criminal defence, family law, immigration, bankruptcy, employment disputes, and anything touching mental health or addiction, it is genuinely harmful, and it is harmful to the very person the duty exists to protect.

Notice how easily this happens by accident. "We are sorry your matter did not resolve the way you hoped" confirms a matter. "Thank you for trusting us during a difficult time" confirms a matter. "Please call the office and ask for the attorney who handled your file" confirms a matter. A reply that is warm, apologetic, and completely non-specific can still be a confidentiality breach, because the confirmation is doing the disclosing, not the detail. And it runs the other way too. Duties to prospective clients apply to people who came in for a consultation and never signed, so a reply denying that someone was ever a client can be its own problem when the person did in fact sit in your conference room and describe their situation for forty minutes.

The self-defence exception is much narrower than it sounds

Every lawyer who has read the confidentiality rule remembers that there is a self-defence carve-out, and almost every lawyer overestimates it. Under the ABA Model Rules the exception permits disclosure to respond to allegations in a proceeding concerning the lawyer's representation of the client, or to establish a claim or defence in a controversy between lawyer and client. ABA Formal Opinion 496, issued in 2021, addressed online criticism directly and took the position that a negative review is not by itself the kind of controversy or proceeding that opens that door. Formal opinions are advisory rather than binding, and state rules and interpretations differ, but a firm planning to rely on self-defence to answer a Google review is planning on the weakest possible reading of the rule.

The logic behind that position is worth understanding, because it holds up outside the United States as well. The exception exists so that a lawyer facing a fee suit, a malpractice claim, or a disciplinary complaint can defend themselves in a forum with rules of evidence, a decision maker, and a record. A review site has none of those. There is no tribunal, no confidentiality protections around the response, and no way to limit disclosure to what is reasonably necessary, which is the standard the exception itself imposes wherever it appears. Regulators in England and Wales, Canada, and Australia all frame confidentiality with similarly narrow release points, so the reasonable working rule in any common-law market is that a public review does not unlock the file. If the complaint escalates into an actual bar complaint or a fee dispute, that is a different process with different rules, and it is the point at which you get to answer with facts.

What a reply that holds up actually contains

A compliant reply is short, generic, and structurally identical every time. It thanks the reader for the feedback without confirming who they are, states something true about how the firm operates as a matter of policy, notes that professional obligations prevent the firm from discussing any specific matter publicly, and offers a named private channel for anyone who wants to raise a concern directly. That is the whole thing. Four sentences maximum, no adjectives doing emotional work, and no clause that would only make sense if the reviewer were a client.

The line that does most of the load-bearing is the confidentiality note itself, because it explains the silence without apologising for it. Something along the lines of professional rules preventing the firm from responding to comments about any individual matter reads as principled rather than evasive, and readers understand it immediately. What you must resist is the urge to add one qualifying clause. Every version of "while we cannot discuss specifics, we always" is an invitation to write a sentence that implicitly rebuts the review, and an implicit rebuttal about a specific matter is still a statement about that matter. Write the four sentences once, get them reviewed, save them as the firm's standard response, and stop rewriting them under pressure at nine at night.

Reviews from people who were never your clients

A meaningful share of one-star reviews on law firm listings do not come from clients. They come from opposing parties, relatives of opposing parties, opposing counsel's disgruntled client, someone who was refused a consultation, a candidate the firm did not hire, and occasionally a competitor. This category is genuinely different, because there is no confidentiality duty owed to a stranger, and it is also the category where firms most often overreact and make the situation worse.

The correct first move is almost never a reply. Most major review platforms have policies against reviews posted by people with a conflict of interest or no genuine experience of the business, and the removal path runs through the platform's own reporting process rather than through the comment box. Report it, document what you reported and when, and be patient, because these processes are slow and inconsistent. If it survives the report and it is materially defamatory, that is a decision to make with counsel and with clear eyes about cost, timeline, and the fact that suing over a review reliably produces more attention for the review than the review had on its own. And note the trap even here: if the reviewer is an opposing party in a live matter, a public reply naming them as such can disclose information about your client's case, so the absence of a duty to the reviewer does not mean there is no duty in the room.

Asking is the half most firms get completely wrong

Firms obsess over the negative review and neglect the only thing that actually fixes a review profile, which is a steady flow of genuine positive ones. Most firms ask badly. They ask in a mass email to the whole client list, they ask months after the matter closed when the client has moved on, they ask through a marketing automation tool nobody in the firm has read the compliance implications of, and they ask in a way that puts a specific outcome front and centre. Each of those is a separate problem, and the last one is a regulatory problem rather than a stylistic one.

Advertising rules in most common-law jurisdictions prohibit communications about a lawyer's services that are false or misleading, and a testimonial that highlights a result can create unjustified expectations about what the firm can achieve in a different case. Several United States jurisdictions require specific disclaimers alongside results-based testimonials, and some Australian states impose real restrictions on personal injury advertising in particular. That does not mean you cannot ask for reviews. It means the ask should steer the client toward describing the experience of working with the firm, communication, clarity, responsiveness, rather than toward reciting an outcome and a number. Ask about the process and you get reviews that are both more compliant and, as it happens, more persuasive to the next person reading them.

The moment that actually produces a review

There is a narrow window in every matter when a satisfied client will write something, and it is not the day the final invoice goes out. Asking alongside a bill converts a request for a favour into what feels like a condition of the transaction, and it lands at the exact moment the client is most price-sensitive. Asking six months later, after the relief has faded and the details have blurred, produces silence or something generic enough to be useless. The moment that works is the one right after a visible win: the settlement signed, the order entered, the closing completed, the status change the client has been waiting on for weeks.

The other timing rule is that you should be extremely reluctant to ask while a matter is still open. A client whose case, funds, and outcome are in your hands is not in a position to decline a request from you freely, and that pressure is real whether or not anyone in the firm intends it. It also creates the worst possible sequencing risk, where a five-star review posted during discovery sits permanently above a matter that later goes badly. Wait for the file to close, then ask within the first week or two while the experience is still specific enough for the client to describe in their own words.

Building the ask into the matter rather than into a marketing task

The reason review requests do not happen consistently is that they live nowhere. They belong to marketing, which does not know which matters closed this week, and the attorneys who do know are not thinking about review profiles on the day they close a file. The fix is to attach the trigger to the thing that already changes when a matter ends, which is the matter's own stage. Casely's matter stage tracker sits at the top of the file as a clickable stepper configured per firm and per practice area, so the transition into a closing or closed stage is a defined event in the system rather than a thing somebody remembers, and that event is exactly where a review request belongs.

Attaching it to the stage also solves the targeting problem. Not every closed matter should generate an ask. Practice areas where a public review would out the client should be excluded at the practice-area level rather than filtered by hand each time. Matters that ended badly should be excluded on the handling attorney's judgment. Contact labels are useful here too, because a client already tagged as a referral source or a repeat client is a different kind of ask from a one-time transactional matter, and knowing which is which before you send anything is the difference between a request that feels personal and one that feels like a mail merge.

What you can and cannot offer in exchange

The temptation to incentivise reviews is strong and the rules around it are unforgiving. Under the ABA Model Rules a lawyer may not give anything of value to a person for recommending the lawyer's services, with narrow exceptions including nominal gifts of appreciation that are not offered as an inducement or in exchange. Read that carefully, because the distinction is not the amount, it is the exchange. A modest thank-you note sent after a review appeared, with no prior promise, sits differently from a gift card advertised in the request email, and some jurisdictions are stricter than the model rule regardless.

There is a second layer beyond professional conduct rules. Consumer protection regulators in several markets treat incentivised or undisclosed-connection endorsements as deceptive advertising in their own right, which means a review generated by an incentive may need to disclose that fact to be lawful even before you get to the bar rules. The simplest safe posture, and the one that avoids having to reason about two overlapping regimes on a deadline, is to offer nothing at all. Ask, explain honestly why it helps the firm, make it easy, and accept a lower response rate in exchange for never having to defend the mechanism.

Who owns the response, and who must not touch the file

Public responses need exactly one owner, named in writing, with a defined turnaround such as two business days. The failure mode in firms without that rule is predictable: an associate sees the review, feels defensive on the firm's behalf, and posts a reply from the firm's account at eleven at night that contains one sentence too many. Once it is posted it has been read, screenshotted, and indexed, and deleting it does not undo any of that. One owner, one saved template, and a standing instruction that nobody else replies is the entire policy.

There is a subtler control worth thinking about, which is who can open the underlying matter while drafting. The people most likely to be tasked with reviews are marketing and business development staff, and those are exactly the people who should not be pulling up a family law file to work out what happened. This is where server-enforced access control matters rather than interface tidiness. Casely enforces ethical walls at the data-access layer, so a walled user genuinely cannot reach a restricted matter by any route, including search, calendar, or a forwarded link, and a permission model that actually holds means the person writing the public reply is structurally unable to see the material they must not use. That is a better safeguard than trusting good intentions at the end of a long week.

Fixing the thing the review was usually about

Read a hundred negative law firm reviews and the pattern is not about losing. It is about not knowing. Clients complain that nobody returned calls, that they had no idea what stage their matter was in for weeks at a time, that they got an invoice with a number they did not expect, that they never understood what they were paying for. Outcome complaints exist, but they are a minority, and they are the ones a firm has the least power to change. The communication and billing complaints are almost entirely operational, and operational problems have operational fixes.

That reframes review management as something you mostly do upstream. A real-time client portal that shows the current stage of the matter and the documents relevant to it, privilege-filtered automatically per document so nothing internal leaks, removes most of the "nobody told me anything" review before it is ever written, because the client can simply look. Billing surprise responds to the same treatment: one-click invoicing that turns unbilled time into a single itemised draft produces a bill the client can actually read, with the work described line by line, rather than a lump sum that arrives without explanation. Neither of those is a marketing initiative. Both of them move the review profile more than any reply you will ever write.

Treat reviews as an operations output, not a marketing campaign

The firms that do well here are not the ones with the cleverest response template. They are the ones where the ask is wired into the close of a matter so it happens every time, where the response is owned by one person working from a script written calmly in advance, and where the underlying experience is good enough that most clients have something honest and positive to say. The confidentiality constraint is real and it is permanent, but it only bites hard when a firm has let the review page become the only feedback channel it has. Give clients somewhere to complain privately while the matter is still open and far fewer of them will choose the public option later.

Build the mechanics once. Decide which practice areas are excluded, write the four-sentence reply and have it reviewed against your own jurisdiction's rules, name the owner, set the stage-based trigger, and log every review and response against the contact record so the pattern is visible across a year rather than argued about one post at a time. Then leave the template alone. The whole point of writing it in advance is that you never have to make this decision while angry, and reviews are one of the few areas of practice where the worst outcome is almost always caused by a fast response rather than a slow one.

Most of this lives in the systems you already run the firm on rather than in a separate reputation tool. If the visibility gap is what your reviews keep pointing at, start with client portal software for law firms and see how much of the complaint disappears when the client can answer their own status question at ten at night. If the pattern is billing surprise instead, the fix is on the legal billing software side, in invoices that explain themselves. Either way, confirm the advertising and confidentiality rules that apply in your jurisdiction before you publish a word, because on this subject the model rules are a starting point and your regulator is the authority.