Your website is advertising, and your contact form is a confidentiality question
Two things make a law firm site different. Everything on it is subject to professional conduct rules on advertising and solicitation, and an unsolicited message from a prospective client raises duties before anybody has been engaged.
Why people arrive here
Usually a partner reading the state bar advertising rules properly for the first time in years, or a conflicts problem arising from something somebody typed into a contact form.
What bites hardest
These are the same obligations every business website carries. In this sector they are the ones that produce letters first.
ADA web accessibility
Title III of the Americans with Disabilities Act requires places of public accommodation to be accessible to people with disabilities. The Department of Justice takes the position that this reaches the websites of businesses open to the public, and has published guidance saying so.
CCPA and CPRA
California privacy law gives consumers rights over personal information a business collects about them, and imposes duties on businesses that meet one of three thresholds. It is enforced by the California Privacy Protection Agency and the Attorney General.
Data requests
A data subject request, or consumer request, is somebody exercising a legal right over the personal information you hold about them: to know what you have, to get a copy, to correct it, to delete it, or to opt out of its sale or sharing.
Breach notification
A legal duty to tell affected people, and often a regulator, after personal information you hold has been acquired by somebody who should not have it. Every US state has such a law, and so do the EU and UK under the GDPR.
Sector rules to watch
These reach this sector specifically and have no page in the library yet. Each one is a question for a lawyer who knows your business.
- State bar advertising and solicitation rules
Professional conduct rules govern what a firm may say about itself, what constitutes a communication about services, and what disclaimers are required. These are state rules and they differ, so the model rules are a starting point and your own state bar is the authority.
Model Rules of Professional Conduct, Rules 7.1 to 7.3American Bar Association
- Duties to prospective clients
Information learned from a prospective client can create duties even where no engagement follows, including a potential conflict. A contact form that invites case details invites exactly that, which is why the wording around the form matters as much as the form.
Model Rule 1.18: Duties to a Prospective ClientAmerican Bar Association
What WebSpark does
- Contact forms carry the wording your firm approves, and that wording is a content field under the same approval trail as any other page, so it cannot be quietly edited.
- Submissions are stored with a defined retention and are deletable on request, which matters when a prospective client asks you to remove what they sent.
- Every page tested against WCAG 2.2 AA before it publishes, with a dated record of what was found.
- Consent that matches the region a visitor is in, with nothing third-party loading before a grant.
- Data requests logged with their arrival date and tracked against the statutory deadline.
- A monthly operations record you can hand to a customer, an insurer or a funder.
What stays yours
- Everything about what the site says regarding your services, results and specialization. Those are professional conduct questions and we do not advise on them.
- Conflicts checking, and what you do with information arriving through the form.
WebSpark describes obligations and evidences what a site does. It does not provide legal advice, and this page is not a substitute for a lawyer who knows your business and your state.