Attorney Review Management: The Self-Defence Exception Does Not Cover a Bad Review

Attorney review management is sold to law firms the same way it is sold to restaurants: reply fast, reply warmly, watch the rating climb. For a law firm that advice is not merely unhelpful, it is the advice that gets lawyers disciplined. A restaurant replying to a bad review risks an awkward paragraph. A lawyer replying to a bad review is making a disclosure decision under the confidentiality rule, and the American Bar Association and at least two state bars have now published opinions telling lawyers, in writing, that the obvious reply is the wrong one.

Why attorney review management is an ethics problem before it is a marketing problem

A former client posts two stars saying the firm never returned calls, missed a deadline and overbilled. The partner who reads it knows the file. They know the client cancelled two meetings, that the deadline moved because the other side filed late, and that the bill reflected work the client requested in writing. Every one of those corrections is information relating to the representation of a client, and posting it in public is a disclosure.

The reasoning most firms reach for is the self-defence exception: the client attacked us publicly, so we are entitled to answer. That exception is real, it is narrow, and the ABA has said plainly that it does not stretch this far. Announcing Formal Opinion 496 on 13 January 2021, the association stated that “a negative online review, alone, does not meet the requirements of permissible disclosure under the ‘self-defense’ provision”, and that lawyers “should consider not responding”.

That is a different constraint from the one a medical practice works under, and firms that borrow a healthcare policy get it subtly wrong. Protected health information is a defined category. Information relating to the representation is everything, whatever its source, whether or not it is embarrassing and whether or not the client has already mentioned it. The healthcare version of this problem, and the enforcement actions behind it, is set out in dentist review management, and the shape is familiar even though the rule is not the same one.

None of this makes a law firm profile unanswerable. It means the reply is written to a narrow specification, agreed in advance, by someone who has read the opinions. The generic templates in responding to negative Google reviews are a reasonable starting shape and a bad finished product for a firm, because almost every one of them contains a sentence that confirms a representation.

What the published opinions actually say

Three documents cover most of the ground. They do not agree on tone, and the difference between them is the most useful thing a firm can know, because it tells you how much room your own jurisdiction is likely to give you. All three were read on 30 September 2026.

The ABA is the most cautious. Formal Opinion 496 concludes that the self-defence provision does not cover a negative review on its own, tells lawyers to consider not responding at all, and describes the safe move as posting an invitation to contact the lawyer privately. It is guidance, not a rule, but state bars read it.

Wisconsin went further. Formal Ethics Opinion EF-23-01, issued 22 June 2023, concludes that “no response at all will almost always be the lawyer’s best option”, states that a lawyer may not reveal information relating to the representation without the client’s informed consent, and confirms that the self-defence exception does not apply to an informal dispute on social media. Where a response is judged necessary, the opinion offers wording.

“I do not believe the [post/comments] are fair or accurate. Professional obligations prevent me from commenting further.”

— State Bar of Wisconsin, Formal Ethics Opinion EF-23-01, 22 June 2023

North Carolina is the most permissive of the three, and the most practically useful. 2020 Formal Ethics Opinion 1, adopted 16 July 2021, allows a lawyer to post a professional and restrained response that does not reveal any confidential information, and says the lawyer “may not reveal confidential information in response to the negative online review unless the former client consents or an exception set out in Rule 1.6(b) applies”. A response may deny the accuracy of a claim; it may not use client information to contradict a specific allegation.

The same North Carolina opinion answers the question every firm eventually asks, about the reviewer who was never a client at all. Asked whether a lawyer may say so publicly, the opinion answers: “Yes. The duty of confidentiality set out in Rule 1.6 only applies to information obtained during a lawyer-client relationship.” That is the one factual correction a firm can reliably make in public, and it is worth knowing precisely because so little else is available.

Read together the three set a floor and a ceiling. The floor is that you may always acknowledge and invite the conversation offline. The ceiling is that you may deny accuracy in general terms and, where true, deny that the person was ever a client. Everything between those two points depends on your jurisdiction, and the honest answer for a multi-state firm is to write the policy to the strictest state it practises in.

The four moves a law firm reply is allowed, and the five it is not

Written as an operating rule rather than an essay, the permitted reply is short. Acknowledge that feedback was left. State the firm’s general standard without reference to this matter. Give a named route to continue privately. Stop. The discipline is entirely in the stopping.

• Never confirm that the reviewer was a client. “We are sorry your matter did not go as you hoped” confirms a representation. “Thank you for taking the time to leave feedback” does not.
• Never name a matter, a court, a date, a deadline or a piece of correspondence. The missed meetings and the moved deadline are the strongest facts you hold and the clearest disclosures you can make.
• Never discuss fees, billing or the scope of the engagement. Fee complaints are the most common trigger and the most tempting to answer with an invoice line.
• Never contradict the reviewer’s account with anything from the file. North Carolina permits a general denial of accuracy. It does not permit the evidence.
• Never threaten, and never hint at one. A reply that mentions defamation converts a single bad review into a story, and several of the reported disciplinary matters in this area started with exactly that sentence.
• Do give a specific route offline. A named role, a direct line and a commitment to a timeframe: “Please ask for our client care partner on the number on our profile and we will call you back within one working day.”

Two approved openings are enough for most firms. One for a complaint about service, communication or delay. One for a complaint about fees. Both end at the offline invitation, and neither is to be improvised on. A partner writing at eleven at night after reading something unfair about themselves is the single highest-risk author in the firm, which is the argument for having the words already written.

The restraint applies to positive reviews too, and firms forget it there. Replying to a five-star review with “delighted we could get the settlement over the line for you” confirms a representation and its outcome, cheerfully, in public. Keep the thanks general.

What a firm is allowed to ask for

Review generation is where legal marketing advice most often collides with platform policy. Google’s prohibited and restricted content policy, read on 30 September 2026, states that merchants must not “Offer incentives - such as payment, discounts, free goods and/or services - in exchange for posting any review”. A fee discount for a review is exactly that, and for a firm it is a bar problem as well as a Google one.

The same policy is clearer than most firms expect about what is allowed: merchants may “Solicit or encourage the posting of content that does represent a genuine experience, without offering incentives”. Asking every client at the closing letter is permitted. Asking only the ones who sounded pleased is review gating, which distorts the rating and tells you nothing you can act on.

Two further clauses catch firms specifically. Google prohibits content based on a conflict of interest, defined to include “current or former employment, a contractual or consultory relationship, or other professional or personal affiliations”, which covers reviews written by paralegals, consultants and referral partners. And it prohibits content “posted from multiple accounts by or at the request of one person”. When a review genuinely does breach policy, the removal route is narrow and slow, and reporting fake reviews for removal sets out what works and what wastes a fortnight.

It is also worth remembering that a firm’s reputation is not only on Google. Practices that run a client portal or an intake app collect ratings in the App Store and on Google Play, and a developer response on a store listing is exactly as public, and exactly as governed by the confidentiality rule, as a Google reply. The surface changes; the duty does not.

The approval workflow that makes a compliant reply fast

Firms solve this badly in two familiar ways. Either the managing partner writes every reply personally, which is safe and takes a month, or marketing replies the same day, which is fast and is how the disciplinary matters start. The workable split is that whoever knows the matter drafts, and one named person with the opinions in their head approves before anything is published.

That is the whole purpose of an approval workflow in a regulated setting. It keeps the drafting close to the facts and the publishing under control, and it costs minutes.

1. Write the policy once: the four permitted moves, the five forbidden ones, the two approved openings, and the jurisdictions the firm practises in. One page.
2. Name one approver and one deputy. A reply that cannot be approved because someone is in court is a reply that gets published unapproved.
3. Set the target on time to publish rather than time to draft. Two working days is realistic for a single office.
4. Log the review, the draft, the approver and the publish time. If a bar ever asks how the firm controls public statements about matters, that log is the answer.
5. Read the log monthly and count how many drafts were edited at approval. A number that never falls means the policy is not being read.

Multi-office firms have the same problem multiplied, and one extra wrinkle: the strictest jurisdiction governs the template. A central marketing team replying on behalf of nine offices needs one policy written to the tightest rule, not nine written to local taste. The delegation pattern is the same one set out in multi-location review management: drafting local, approval central. ReviewMankey’s draft and approval workflow is built for exactly this shape, and it applies the same controls whether the review arrived on Google, the App Store or Google Play.

The clock deserves to be set deliberately rather than inherited. A complaint alleging a missed limitation date and a complaint about parking do not deserve the same urgency. The review response time SLA playbook covers how to set a target that survives a busy practice, and the legal version simply puts the approval step inside the target rather than after it.

The numbers a firm should actually track

Star rating is the number every firm watches and the slowest to move. These five say more about whether anything is improving, and all of them can be counted in a spreadsheet long before a dashboard is worth paying for.

• Response rate and time to publish. Measure to publication. The gap between draft and publish is the true size of the approval bottleneck.
• Review velocity. New reviews per month per office. A stable rating with falling review velocity is a profile going quiet, which is the same problem arriving slowly.
• Top three complaint causes by count. Communication, delay, fee surprise, outcome expectation, intake experience. Count causes, not stars.
• Share of reviews naming a fee-earner. Clients volunteer this unprompted, and it is the cheapest leading indicator of service quality a firm has.
• Drafts edited at approval. The only number that measures the compliance control rather than the reputation.

For the wider consumer context, the review management statistics page collects the published research with each figure attributed to its source. Use it to set expectations with a management committee, not as a substitute for the five numbers above, which are the only ones that describe your firm.

Fee surprise deserves a special mention because it is the complaint most likely to tempt a public correction and the one where a public correction is most obviously a disclosure. If the same fee complaint appears three times in a quarter, the fix is in the engagement letter conversation, not in the reply box.

Attorney review management done properly looks dull: two approved openings, one named approver, a two-day publish target, and a monthly count of causes. It is less exciting than a reputation dashboard and it is the version that does not end in a grievance file. For the industry view with the platforms and the workflow laid out together, the legal review management use case covers how the pieces fit for a firm managing Google, the app stores and client feedback in one place.