Lawyers responding to bad reviews face a problem no other profession really has — the response itself is bounded by ABA Model Rule 1.6, the rule on client confidentiality. A restaurant owner whose customer leaves a one-star review claiming the steak was undercooked can publicly say “We’re sorry — we cooked your steak to the temperature you ordered, which the server has noted in our records.” The lawyer whose former client leaves a one-star review claiming the firm “lied” or “did nothing on my case” cannot say “Actually, we filed three motions, attended four hearings, and the outcome was the best available given the facts of the case.” Saying that publicly is a Rule 1.6 violation. Even if everything in it is true. Even if the client started it.
This is the trap. Most public-facing review-response advice — “respond promptly, acknowledge the specific concern, offer to resolve it privately” — doesn’t account for the fact that lawyers can’t acknowledge specific concerns without revealing client confidences. Almost every law firm I audit either responds wrong (revealing confidential information defensively) or doesn’t respond at all (which has its own problems). This page is the version of the response playbook that actually works inside Rule 1.6.
What Rule 1.6 actually says, in plain English
ABA Model Rule 1.6 prohibits a lawyer from revealing information related to the representation of a client without informed consent. The rule has been interpreted broadly. “Information related to the representation” includes essentially everything the lawyer learned in the course of representing the client — including the fact of representation itself, the nature of the matter, the work done, the fee paid, the outcome, and any conversations between lawyer and client.
There are exceptions. The big ones — informed consent from the client; implied authority to disclose in furtherance of the representation; disclosure necessary to prevent reasonably certain death or substantial bodily harm; disclosure necessary to establish a claim or defense in a controversy between the lawyer and the client. That last exception is the one most lawyers think they can use to respond to a bad review. They mostly can’t. State bar opinions on the question have come down with surprising consistency — a negative online review is not a “controversy between the lawyer and the client” within the meaning of the self-defense exception unless and until it escalates to a formal proceeding (a fee dispute, a malpractice claim, a bar complaint).
Multiple state bar associations have issued formal ethics opinions on this. The Pennsylvania Bar, the Texas Bar, the New York State Bar, the LA County Bar — all have published opinions that effectively say “responding to a negative online review by disclosing client information is a Rule 1.6 violation, even if the review is factually wrong, even if the lawyer feels defamed.” The pattern is consistent. The self-defense exception is narrow. Public review responses don’t qualify.
The temptation to defend yourself publicly is the trap. The bar opinion you’d end up reading after the complaint is filed has already been written — for someone else, on this exact issue, in your state — and it says you should have kept your mouth shut.
What you can disclose publicly (almost nothing)
The list of what you can publicly say about a former client’s matter is short. You can confirm publicly available information that already exists in the public record (court filings, judgments, etc.) — but doing so identifies the client and is still risky. You can describe the firm’s general practices (“Our firm typically responds to client inquiries within 24 hours”). You can speak in generalities about the kinds of cases the firm handles. You cannot confirm or deny that a specific person was your client. You cannot describe what you did or didn’t do on their case. You cannot characterize the outcome.
This is the harder version of the rule than most lawyers expect. The reflexive response — “they were never even our client” or “we never billed them what they say” — is itself a 1.6 violation in most states. You can’t even confirm or deny representation publicly without consent. The information that the person was or wasn’t a client is “information related to the representation.”
Practically — for the bad review, your public response cannot contain any of the following: confirmation that the reviewer was a client; description of the matter; description of what was or wasn’t done; description of the outcome; description of fees or billing; description of any communication between the firm and the reviewer; rebuttal of any specific claim the reviewer made.
The response template that maintains confidentiality
Given the constraints, the response that works is short, professional, doesn’t engage with specifics, and offers a private channel. Something like — “Thank you for taking the time to share this feedback. We take client concerns seriously, and while we cannot discuss specific matters publicly, we’d welcome the opportunity to speak with you directly. Please contact our office at [phone number] and ask for [managing partner / office manager].” That response is four sentences. It accomplishes everything that’s available to accomplish without revealing anything.
What it does — it acknowledges the review exists (other prospects reading the profile see the firm engages). It signals professionalism (the firm is composed, not defensive). It implies without confirming that there may be more to the story (sophisticated readers will infer the firm is constrained by ethics rules and read the review accordingly). It offers a real private channel. It doesn’t escalate.
What to avoid in the response — anything specific. “We never represented you” is bad. “Our records show we returned all your calls within 24 hours” is bad. “Your case was actually dismissed in your favor” is bad. “We refunded the entire retainer last March” is bad. All of these are confidentiality violations even if they’re true and even if the reviewer’s claim is false. The bar doesn’t grade on a curve — “they started it” is not a defense to a 1.6 complaint.
The “thank you and please contact our office” pattern
The template above is one version of what I call the “thank you and please contact our office” pattern. The pattern is the safe default for almost any bad review. Vary the wording so it doesn’t read as copy-pasted across responses (sophisticated prospects do read the patterns), but keep the structure. Acknowledge. Decline to engage specifically. Offer a private channel. Sign off professionally.
Variations that work — “We’re sorry to hear about your experience. Out of respect for client confidentiality we can’t discuss specifics publicly, but please feel free to call our office directly so we can understand your concerns.” Or — “Reviews are how we improve as a firm. Confidentiality rules prevent us from discussing individual matters in public, but our office would welcome a direct conversation. Please contact us at [phone] when convenient.” Or — “We appreciate every piece of feedback. Bar rules prevent us from discussing specific matters in this forum, but we encourage you to contact our office directly to discuss your concerns.”
The mention of “bar rules” or “confidentiality” in the response does double duty. It explains to the reviewer (and to anyone reading) why the response isn’t engaging with the specifics. It signals that the lawyer is being professional rather than evasive. And it implicitly invites the prospect reading the profile to consider that there’s a story the firm can’t tell publicly.
When to NOT respond at all
Sometimes the right move is no response. The cases where I tell firms to not respond — reviews from clearly fake accounts (no profile, no other reviews, suspicious posting pattern), reviews from non-clients who appear to be venting about a different lawyer or about the legal system generally, reviews so unhinged that any response will fuel further posting, reviews that are quite clearly written by a former opposing party or a disgruntled employee rather than a former client.
For the fake-account category — Google has a process for flagging reviews that violate their terms (fake, conflict of interest, spam). The process is imperfect — flagged reviews don’t always come down — but it’s the right first step before responding. Responding to a fake review legitimizes it. Flagging it and waiting is the better play. See the deeper treatment in handling fake or defamatory reviews.
For the unhinged or rage-posting category — the response will not satisfy the reviewer and will likely escalate. Some people post bad reviews because they want a public fight. A non-response denies them the fight. The single bad review without a response reads to most prospects as an outlier. The bad review followed by an escalating thread of responses reads as a firm that has trouble managing conflict.
For the non-client venting — sometimes a reviewer is reviewing the wrong firm, or reviewing the legal system generally, or angry about a case where the firm wasn’t actually involved. The response template above still works (“we have no record of representing you, and our confidentiality rules prevent us from discussing specifics” — note: still no client confirmation either way). If the review is clearly mistaken identity, flagging Google for removal is the better path than responding.
The emotional discipline required
The hardest part of bad-review response isn’t the wording. It’s the emotional discipline. Lawyers are professional advocates. The instinct when attacked is to advocate. The instinct when accused falsely is to correct. The instinct when a former client lies about the firm is to set the record straight. All three of those instincts produce 1.6 violations under almost every state’s interpretation of the rule.
The discipline is to read the bad review, feel whatever you feel about it, wait at least 24 hours, and then respond with the template above. Don’t respond the same day. Don’t respond from the angry place. Don’t write the response that “really tells them” and then “tone it down” — the toned-down version still contains the confidential information the angry version started with. Start from the template. Don’t deviate.
The other emotional trap is the firm partner who wants to “set the record straight” because the bad review is hurting referrals or making other partners uncomfortable. That pressure is real, and it’s still wrong. The harm of a single bad review is almost always overstated. The harm of a confidentiality violation, prosecuted by the bar, is real and permanent. Prospects reading the profile see the bad review in context with the other reviews. One unrebutted bad review in a profile of fifty positive reviews reads as an outlier. A bar reprimand reads as a career problem.
When to escalate to formal flag or legal channels
For reviews that cross into defamation, the formal channels are flag-the-review with the platform, lawyer letter to the reviewer (carefully drafted — see below), and in rare cases formal litigation. Each has tradeoffs.
Flagging with Google is the cheapest first step. Google removes reviews that violate their content policies (off-topic, fake, conflict of interest, hateful, sexually explicit, profanity, harassment, impersonation). Reviews that are merely negative or unfair are not policy violations and won’t come down. A review that calls a lawyer “incompetent” stays up. A review that says “this lawyer punched me in the face during a meeting” is more likely to come down as harassment or as a false claim. Be specific in the flag — cite the policy you believe the review violates and why. Generic “this is a fake review” flags get auto-rejected.
The lawyer letter to the reviewer is sometimes appropriate for clearly defamatory content where the reviewer is identifiable. The letter should be measured — outline the false statements, demand retraction, note potential legal exposure if not retracted. This works on some reviewers and backfires on others (some will post the letter publicly and the firm gets a Streisand-effect problem). Use sparingly, and have a litigator who handles defamation work draft the letter, not the firm’s general practice attorneys.
Formal defamation litigation is rare and almost always a bad idea against a former client. The discovery process forces the firm to litigate the underlying matter publicly, undermining the original confidentiality protection. The cost is real. The reputational risk is real. Most defamation cases against former clients are lost or settled at a discount, and the litigation itself often damages the firm more than the review did. The decision to litigate should never be made in the immediate aftermath of seeing the review. Wait. Consult outside counsel. Most of the time, the right answer is the template response and moving on.
State bar variation — Florida, Texas, California, New York
Bar rules vary by state. The 1.6 prohibition is essentially universal but the specific interpretations differ. Florida has issued formal ethics opinions reading the self-defense exception very narrowly — Florida lawyers should be especially conservative in response wording. Texas has similar opinions and a strong tradition of bar discipline for online conduct. New York has issued guidance treating online review responses under both 1.6 and the testimonial rules. California’s framework is governed by the Business and Professions Code in addition to the Rules of Professional Conduct — slightly different framework, same practical result.
For Arizona specifically — the home market — Arizona has adopted Rule 1.6 in the ABA form. The State Bar of Arizona has not issued a specific ethics opinion on online review responses but has followed the consistent pattern from other states’ opinions. Conservative interpretation is the safe approach. Arizona lawyers should respond with the template, not with specifics.
If your firm is in a state I haven’t mentioned, the practical answer is the same — assume the conservative interpretation of 1.6 applies until you’ve read your state’s ethics opinions on the question. The bar’s website usually has a search function for opinions. Search “online review” or “social media” and read what comes up. If your state hasn’t directly addressed it, look at the surrounding states’ opinions — bar opinions are persuasive across jurisdictions on issues like this where the underlying rule is uniform.
The bigger picture — bad reviews matter less than firms think
The last thing worth saying. Bad reviews matter less than firm owners imagine. A firm with 120 reviews at a 4.8 average and three one-star reviews is a firm that prospects trust. The three bad reviews actually increase credibility — they signal the profile isn’t manipulated. A firm with 12 reviews at a perfect 5.0 reads as suspicious. A firm with 4 reviews and zero bad ones reads as a firm nobody is actually reviewing.
The implication for response strategy — the bad review is a problem to manage, not a crisis to solve. The template response, applied calmly, maintains the firm’s reputation. The volume of new positive reviews coming in (see Google review strategy for law firms) keeps the overall profile strong. The bad review fades into the background as new reviews accumulate.
The firms that get into trouble are the firms that overreact — that respond defensively, that get into public arguments, that file ill-advised defamation suits, that violate 1.6 in the heat of the moment. The firms that stay disciplined come out fine. Bad reviews are a part of doing legal work. Treat them as such.
Adjacent topics
For the broader review generation conversation see Google review strategy for law firms. For the bar-rule deep dive on solicitation see ABA rules on soliciting client reviews. For the fake-review and defamation deeper conversation see handling fake or defamatory reviews and the answer page on can competitors leave fake reviews. For how to handle reviews across the broader platform landscape see managing reviews across platforms.
For the broader frame on how reviews fit into law firm SEO and trust signaling see the legal SEO authority page and E-E-A-T signals for law firm pages. For how the firm’s overall approach to client communication should reflect these constraints see our approach.
If you want a second set of eyes
The free audit I offer includes a look at your existing review responses. If there’s any 1.6-risk language in published responses, I’ll flag it. If the response patterns are good, I’ll tell you that too. If there’s a specific bad review that needs a careful response and you’re not sure how to handle it, we can talk through it. No deck. No upsell.
— The owner, PHX Search Co.