A workflow for legal marketing compliance

What to take away

Legal marketing compliance keeps public communications accurate, supportable, properly reviewed, and consistent with rules for the firm, its lawyers, its audience, and its channels, and it covers more than advertisements.

Websites, biographies, proposals, rankings, and reviews communicate about legal services. Seminars, directories, social posts, email, and video do too. Sponsorships, lead generation, media statements, and automated content communicate about legal services.

No single national checklist resolves every campaign. Professional rules vary by jurisdiction and may interact with consumer protection, privacy, accessibility, intellectual property, telecommunications, platform, contract, employment, and sector requirements. At the federal level, the FTC Act prohibits unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce, and a practice is deceptive when a representation, omission or practice is likely to mislead a consumer acting reasonably and is material to the consumer's decision about the service. The right question is not whether marketing is generally permitted. It is which communication, directed by whom, to which audience, in which place, through which method, with what evidence and handoff.

Define the compliance unit

Create a record for each material communication or controlled campaign family. Identify the sponsoring firm and responsible lawyer, intended and reasonably foreseeable audiences, services, jurisdictions, channels, targeting logic, vendors, compensation, call to action, landing experience, intake route, data flow, publication window, and planned reuse. A small change in any field can alter the review.

Do not classify by file format alone. A webinar invitation may be a general announcement, a targeted communication, or part of a live solicitation sequence depending on the facts. A review may become an endorsement when selected for an advertisement. A neutral directory entry may become misleading when the firm controls it but lets material facts expire.

Build the authority register

For every active jurisdiction and channel, maintain the adopted professional rules, comments, official opinions, court orders, statutes, regulations, filing or retention requirements, regulator guidance, and material platform terms. Record authority, status, effective date, source URL, responsible reviewer, scope, and next review. Model rules and ethics opinions are useful research inputs, but they are not automatically the governing law.

The American Bar Association's Model Rule 7.1 prohibits false or misleading communications about a lawyer or the lawyer's services and addresses material misrepresentation and omission. It is a model rule. Firms must identify the current rule, decisions, and guidance adopted in every relevant jurisdiction. The Model Rules amendment history shows how recent and how uneven that adoption is: as of March 2020, the most recent amendment was in August 2018, when the House of Delegates approved changes to Model Rule 7 on attorney advertising and client solicitation, and California remained an outlier until November 2018, when new ethics rules modeled after the Model Rules went into effect.

Use a difference log instead of assuming states match the model text. Capture terminology, definitions, responsible-party language, recordkeeping, review or filing duties, specialist statements, trade names, testimonials, results, targeting, solicitation, disclaimers, office descriptions, referrals, and choice-of-law provisions. Filing and disclaimer duties are state-specific: The Florida Bar requires certain advertisements to be filed with the Bar for review before they run, and Texas requires most public advertisements to be filed with the State Bar of Texas Advertising Review Committee. New York requires certain advertisements to carry the label "Attorney Advertising" on the first page or first screen. Record the filing receipt, the filed version, and the required label in the register. When the answer is unclear, pause the communication and obtain qualified advice.

Create the claim register

List each express claim and each important inference a reasonable member of the audience may take from the full presentation. Cover identity, admission, authority, practice scope, location, availability, experience, outcome, ranking, comparison, price, timing, quality, technology, security, privacy, accessibility, independence, sponsorship, and urgency. Tie objective claims to evidence held before publication.

Review the headline, image, typography, sequence, audio, button, qualification, and destination together. A technically true sentence can mislead when paired with an unrelated success image, an unrepresentative result, a buried limit, or a landing page that expands the promise. Fix the main message rather than relying on distant fine print to reverse it.

Separate channels by risk

Set risk tiers before work enters review. Low-risk items may update an approved factual field without changing meaning, while medium-risk items may add new page, audience, campaign.

High-risk items: outcomes, comparisons, specialist claims, vulnerable audiences, targeted contact. Also high-risk: paid recommendations, material incentives, incidents, sensitive data, untested technology claims. Risk tier determines reviewer, evidence, test, and release authority, and risk tiers work only if the firm's overall law firm marketing strategy assigns review authority and evidence per channel.

Design the approval workflow

The request should arrive as a complete package: business objective, audience, jurisdictions, channel, final copy and media, claim register, sources, qualifications, targeting, budget, landing page, form behavior, vendor roles, data map, accessibility review, publication dates, and archive plan. Reviewers should not approve placeholders or a script without the destination it promotes.

Use versioned approvals and record conditions. A condition might limit a claim to one jurisdiction, require adjacent wording, restrict a list, expire a statistic, or prohibit use in paid media. Reapproval should trigger when material words, visuals, targeting, placement, landing page, jurisdiction, vendor, data collection, or publication date changes.

Supervise people and suppliers

Train employees and vendors by role. A writer needs claim and source rules. A media buyer needs audience, location, placement, and landing-page limits. Intake staff need approved scripts, relationship boundaries, data handling, and escalation. Agencies and lead partners need explicit prohibitions on fake identities, undisclosed incentives, purchased reviews, unsupported rankings, unapproved outreach, and private-data use. Put the rule in the contract, not only in the vendor's description: Model Rule 7.2(b) bars giving anything of value to a person for recommending the lawyer's services, apart from paying the reasonable costs of advertising, and Model Rule 5.4 limits fee sharing with non-lawyers. Test every paid lead arrangement against the adopted version of those rules in each jurisdiction where the firm advertises.

The firm should own critical accounts and preserve audit access. Require named users, least privilege, multifactor authentication, disclosed subcontractors, approved methods, incident reporting, correction service levels, exportable records, retention and deletion terms, and tested offboarding. Paying a vendor does not turn an impermissible act into an acceptable one.

Preserve publication evidence

Archive the final artifact as delivered, not only the editable source. For dynamic campaigns, preserve representative placements, audience settings, dates, spend, destination versions, platform notices, and meaningful changes. Capture page screenshots or exports, sent messages, recordings, forms, confirmation states, and the evidence register. Protect privileged or confidential analysis in the correct system.

Monitor controls, not just campaigns

Sample live communications against approved versions. Recheck high-risk claims, active jurisdictions, profile facts, review requests, lead sources. Check direct-contact methods, vendor access, data collection, and inquiry routing.

Find unauthorized variants, expired evidence, broken qualifications, new platform automation, duplicated audiences. Check downstream scripts changed after marketing approval. A law firm social media program needs this sampling discipline for lawyer-approved claims and careful moderation.

Measure control design, operation, and correction separately. Design asks whether a rule and owner exist. Operation asks whether the control was actually followed in a representative sample. Outcome asks whether the process prevented or detected error. Report exceptions by severity, age, recurrence, and affected audience. A 99 percent pass rate can hide one unacceptable high-harm communication.

Respond to a compliance issue

Preserve the live state and evidence before changing it when safe and lawful. Stop or restrict distribution based on severity. Identify affected audiences, jurisdictions, channels, claims, data, vendors, and inquiries. Notify appropriate legal and incident owners. Correct the source and every controlled copy. Consider whether recipients, platforms, clients, regulators, or insurers require notice through qualified review.

Complete a root-cause record. The failure may come from missing evidence, an outdated authority, a weak template, bypassed approval, vendor automation, access control, incentives, training, unclear ownership, or measurement pressure. Correct the system, retest similar items, and verify that the change did not destroy required records.

Run the review cadence

Weekly, clear queued reviews, verify high-risk changes, inspect live variants, resolve urgent corrections.

Monthly, sample every active channel and vendor, review expired claims, reconcile accounts, compare inquiry scripts with approved promises. Quarterly, update jurisdiction differences, test the approval workflow, audit records, exercise issue response, remove obsolete access.

The annual review should revisit the law firm content marketing plan, including audience research and reviewer roles.

Annually, reassess audiences, services, jurisdictions, authority sources, risk tiers, roles, technology, vendors, training, retention, and measurement. Legal marketing compliance works when the firm can show why a communication was permitted, what supported it, what the audience received, and how the firm detected and corrected failure. That evidence is more durable than a generic policy or a perfect-looking dashboard.

Verify legal marketing compliance before release

Verification starts with the authority that governs the item: the rule adopted in the jurisdiction, the filed version where filing is required, and the label or disclaimer that state demands. Check the final artifact as delivered, not the draft, and confirm that the approval conditions still match the placement, audience, and destination.

Then check the promise against evidence: a current admission and role record for status claims, actual results for outcome claims, and a dated test for accessibility and security claims. Test accessibility against Title III of the Americans with Disabilities Act and the Web Content Accessibility Guidelines (WCAG) rather than a self-declaration, and map the data flow against the California Consumer Privacy Act as amended by the California Privacy Rights Act and, for audiences in the European Union, the General Data Protection Regulation.

Finally, check the commercial arrangement: who is paid, for what, and whether the payment buys advertising or a recommendation. Record the tested artifact, the authority sources, the reviewer, the product versions, the exceptions, and the date, and repeat the review when a rule, claim, vendor, account, or destination changes. These checks verify the local implementation; they do not certify a marketing result.

Common questions

Do ABA Model Rules govern every law firm?

No. They are models. Identify the current rules, decisions, and guidance adopted in each relevant jurisdiction.

Does legal approval cover later campaign changes?

Only within the recorded scope and conditions. Material changes to claims, media, audiences, channels, destinations, data, vendors, or timing can require reapproval.

Can an agency handle compliance for the firm?

An agency can support controlled work, but the firm needs qualified decisions, supervision, evidence, account control, and correction authority.

What is the first compliance record to build?

Start with a communication inventory that connects each active item to its audience, jurisdiction, claim evidence, owner, approval, publication state, and expiry.