Responding to Negative Reviews Without Breaching Client Confidentiality

A one-star review lands on your firm’s profile. It misstates the facts, names an attorney, and by afternoon two partners have drafted replies in their heads that would set the record straight in satisfying detail. Sending either draft could be the most expensive paragraph the firm ever publishes. For lawyers, responding to negative reviews is not a customer service exercise. It is an ethics problem with a marketing problem attached, in that order.

The trap is structural. The reviewer can say anything. You are bound by confidentiality duties that do not switch off because a client went public first, and the instinct to correct the record is precisely the instinct that produces bar complaints. This post lays out what the professional guidance actually permits, a response framework that stays inside it, and the reputation strategy that makes any single bad review stop mattering.

The Ethics Baseline Every Partner Should Know

The American Bar Association addressed this squarely in Formal Opinion 496, issued in January 2021, and its guidance on responding to online criticism is the reference point most state bars orbit. The core holdings are sobering for anyone drafting a rebuttal.

• The duty of confidentiality covers all information relating to a representation, not just secrets, and it survives the end of the engagement.
• A negative online review does not qualify as a controversy that unlocks the self-defense exception to confidentiality. You cannot disclose client information to rebut a review.
• Even confirming that the reviewer was a client can itself reveal protected information.
• The opinion’s best-practice suggestion is often the hardest one, consider not responding at all, because replies draw attention and invite escalation.

State bars interpret and supplement this framework in their own opinions, and several have disciplined attorneys for review responses that revealed case details. Before adopting any response policy, check your own state bar’s guidance, and treat everything in this post as marketing process, not legal or ethics advice.

What a Safe Response Actually Looks Like

Within those constraints, a narrow band of response exists, and it works better as marketing than the rebuttal ever would. The safe response has three properties. It never confirms or denies an attorney-client relationship, it never engages with any fact of any matter, and it says something true about the firm generally.

A pattern that stays inside the lines looks like this. Thank the person for the feedback, state that professional confidentiality obligations prevent the firm from discussing any specific matter or confirming whether someone was a client, note the firm’s general commitment to communication and client service, and offer a private channel, inviting the person to call the managing partner directly. Written out, it reads calm, professional, and slightly formal, which is exactly the impression a prospective client scanning your reviews should take away.

What the response must never contain is the tempting material. No timeline corrections, no this-person-never-hired-us, no we-won-that-case, no reference to fees owed, missed appointments, or difficult behavior. Every one of those satisfying details is either a confidentiality breach, an implicit confirmation of the relationship, or fuel for round two.

The Decision Framework, Respond, Report, or Rest

Not every bad review deserves the same move. Triage each one through three questions.

Is It Fake or Prohibited

Reviews from people who never interacted with the firm, competitors, opposing parties in litigation, or accounts with patterns of attack reviews may violate the platform’s content policies. The right move is reporting through the platform’s removal process and documenting everything, not public argument. Opposing-party reviews are a known legal-industry problem, and platforms do remove them, inconsistently but often enough to always try.

Is It Genuine but Unfair

A real former client with a distorted account is the hardest category. This is where the template response earns its keep, one calm reply for the audience of future readers, then stop. The reply is not for the reviewer. It is for the two hundred prospective clients who will read the exchange over the next three years and judge the firm by its composure.

Is It Genuine and Deserved

Sometimes the review is right. A missed call, a fee surprise, a communication failure. The public reply stays inside the same confidentiality lines, but the private response is operational, fix the intake or communication process that produced the review. Firms that treat deserved reviews as free quality-assurance data stop accumulating them.

The Math That Makes One Review Stop Mattering

The strongest response to a negative review is arithmetic. A firm with twelve reviews wears a one-star like a scar. A firm with two hundred wears it like a rounding error, and research on consumer behavior consistently shows that a profile of exclusively perfect reviews reads as less credible than a strong average with visible imperfections.

Volume comes from process, not luck. Ask every satisfied client at the natural moment of gratitude, make the ask effortless with a direct link, and keep the cadence steady so reviews accrue continuously rather than in suspicious bursts. The compliant mechanics, including the state rules on solicitation and the absolute prohibition on incentivized or fabricated reviews, are laid out in our guide to bar-compliant review generation for law firms, and the operational side lives in our law firm review management service.

Review volume and rating also feed local rankings directly, which means the same program that buries a bad review also moves you up the map pack, a double payoff covered in how law firms win the Google local pack.

Platform Mechanics, Where Removal Requests Actually Go

The report-or-respond decision runs through different machinery on each platform, and knowing the lanes saves weeks.

• Google. Flag the review from the profile, then use the reviews management tool to check status and escalate with evidence. Google’s policies prohibit reviews that describe someone else’s experience, conflicts of interest, and off-topic rants, which covers the opposing-party review and the never-a-client review. Removal decisions take days to weeks, and a denied appeal with genuinely new evidence can be worth one more attempt.
• Avvo and the legal directories. These platforms understand the confidentiality bind better than general consumer sites and run their own dispute processes. Reviews from non-clients violate most legal directories’ terms, and a factual, unemotional dispute citing the specific term works better than an outraged one.
• Yelp. The filter does more work than the removal queue. Yelp’s recommendation software already suppresses a large share of reviews on its own, and its removal bar is high. Report clear terms violations, then let it go, because Yelp visibility matters far less for most firms than Google’s.

Whatever the platform, never litigate the facts inside the removal request. The request argues policy, this review violates rule X for reason Y, with evidence that does not itself disclose client information. A firm can breach confidentiality in a removal form just as thoroughly as in a public reply, and the form feels deceptively private. It is not privileged, and it should be written as if the reviewer will one day read it.

Timing deserves a policy line of its own. File platform reports promptly, because review dates anchor everything, but hold the public response until the report resolves. A removed review with a reply attached sometimes survives in cached fragments, and a firm that replied to a review that later vanishes has published a permanent answer to a question nobody can see anymore. Report first, wait, respond only to what remains.

Keep one named person on the platform accounts with working credentials, a verified email, and documented account recovery. Removal requests die silently when the notification lands in an inbox belonging to a coordinator who left two years ago, and platform access is the kind of asset nobody audits until the week it is desperately needed.

Build the Policy Before You Need It

The worst review responses are written in the first hour of anger. A firm policy, one page, adopted in advance, removes the improvisation.

• All review responses go through one designated person, never the attorney named in the review.
• A mandatory cooling period, no response in the first twenty-four hours.
• The approved template language, pre-cleared against your state bar’s guidance.
• The triage framework, respond, report, or rest, applied on paper before anyone types.
• Documentation of every fake-review report submitted to a platform.
• A standing rule that no reply ever references any fact of any matter, with no exceptions for reviews that are provably false.

That last rule feels unjust, and it is still correct. Defamation remedies exist through courts for the rare review that genuinely crosses the line, and that path runs through careful counsel, not through a comment box at 11 p.m.

Composure Is the Brand

Prospective clients do not expect a firm to have zero critics. They are watching how the firm behaves under criticism, because they are imagining how it will behave under the pressure of their case. A profile showing steady five-star volume, the occasional complaint, and unfailingly measured responses is more persuasive than perfection.

Rubiks builds review programs for law firms that handle both halves, the compliant generation engine that makes any single review statistically irrelevant, and the response governance that keeps partners out of trouble at midnight. If your reviews page currently runs on improvisation, talk to Rubiks and we will put a system under it.