Law Firm Website Content Requirements for Bar Compliance

Most attorneys treat bar compliance like a personal question: can a lawyer say this in a bar meeting, can a lawyer say this to a client over coffee. Almost none of them treat it as a website question, which is strange, because the website is the one place a firm's words sit in public, indexed by Google, screenshotted by opposing counsel, and archived by an internet archiving service long after anyone remembers writing them. A law firm website is, at the same time, a marketing asset, a legal document, and a regulated communication channel, and it answers to three separate layers of rules that stack on top of each other rather than replacing one another. This piece walks through those layers, state by state where it matters, because understanding them is the actual starting point before anyone picks a font, writes a blog post, or argues about SEO keywords.

The stakes are not hypothetical. Attorney at Law Magazine reported in October 2024 that lawsuits targeting businesses over website content, accessibility, and compliance violations have climbed in recent years, and law firms get no exemption from that trend just because they're the ones who usually write the lawsuits.

The ABA Model Rules that govern every law firm's website, regardless of state

Every state's attorney advertising rules trace back to the same source material: ABA Model Rules 7.1 through 7.5, since folded and updated into 7.1 through 7.3. Rule 7.1 is the load-bearing wall of the whole structure, and it says something that sounds almost too simple to need saying: a communication is false or misleading if it contains a material misrepresentation of fact or law, or if it leaves out a fact that's needed to keep the whole statement from being misleading. That second half is the one lawyers forget. Leaving something out can be just as much a violation as putting something false in.

The 2018 ABA updates pushed the rule to catch up with how firms actually market themselves now: cross-state client communications, social media as an advertising channel, how a firm can talk about its case results, and a general effort to stop firms from over-promising outcomes to people who haven't hired them yet. Though, the Model Rules are a model. They're not law until a state adopts them, and some states, as of 2025, have not adopted the latest ABA language. So a firm can be perfectly aligned with the ABA's current thinking and still be out of step with its own state bar's older rulebook.

Then there's ABA Formal Opinion 512, issued in 2024, which drags AI squarely into this conversation. The opinion covers legal practice broadly (competence, confidentiality, billing, candor, supervision) but it also flags that advertising issues under Rule 7.1 can surface when AI tools generate marketing content. Comment 8 to Rule 1.1 already reminds lawyers to keep up with the benefits and risks of relevant technology, and put together, the message is blunt: a firm cannot point at a vendor or an AI tool and say "that's who wrote it" as a defense. If it's on the website, it's the firm's words, full stop.

That's the practical takeaway for everything that follows. The ABA sets a floor, not a ceiling. States build on top of it. They almost never take requirements away.

Every digital channel a firm uses counts as attorney advertising

Does a blog post about child custody law feel like an advertisement? Probably not, to the attorney who wrote it. To most state bars, though, it is exactly that. The same rules that govern a billboard or a late-night TV spot apply, in most jurisdictions, to a firm's website, its blog, its Google Ads, its Facebook campaigns, its YouTube channel, and its Avvo or Martindale profile. Commercial speech doesn't stop being commercial speech just because it's dressed up as helpful content.

The list of channels that count as attorney advertising under most state rules runs long: the firm website in its entirety, including every practice area page and attorney bio; SEO content and blog posts; Google Ads; Meta's platforms; YouTube and similar video channels; legal directory profiles; and reviews the firm actively solicited from clients. A blog post explaining the difference between a misdemeanor and a felony reads, to a state bar, no differently than a paid search ad. Both are commercial speech, both fall under the same advertising rules.

That scope changes what "compliance" actually means day to day. It is an ongoing practice, not a website audit performed once, filed away, and forgotten. It's an ongoing obligation attached to every piece of content the firm publishes, boosts, or sponsors, which is exactly why the next section covers disclosures on every page and every form, not just the homepage.

The disclosures every law firm website must carry

Start with the most basic disclosure requirement: naming a human being. Most states require at least one attorney to be identified as responsible for the content on the website, and some states go further in specifying where that name must appear, the page a visitor lands on first. In practice, this usually means the firm name, address, and phone number sit in the footer of every page, with the responsible attorney's name folded into that same footer disclaimer.

Address requirements follow a similar logic. Most jurisdictions want the firm name, the responsible attorney's name, and a physical office or mailing address. Purely virtual firms should verify how their jurisdiction treats address requirements, because the rules vary. If the firm doesn't have a physical office, that's a conversation to have with counsel before launch, not after a complaint.

Jurisdictional disclosure is where multi-state firms tend to trip. Some states require explicit disclosure of where an attorney is actually licensed, and standard guidance recommends contact form disclaimers spell out the firm's jurisdictional limits directly. A firm with attorneys licensed in three states needs its website to reflect exactly that, not something that reads as statewide or nationwide practice when it isn't.

Then there's the disclaimer almost everyone has seen and almost no one reads closely: legal information, not legal advice. Many jurisdictions require it, and one sitewide version is often enough to satisfy the letter of the rule, though putting it on every page, especially blog posts and practice area pages, is the safer bet. Those are exactly the pages a visitor is most likely to mistake for personal advice rather than general information.

Contact forms carry their own separate risk. The point of limiting what a form asks for isn't bureaucratic caution, it's to keep a prospective client from typing out confidential case details before any attorney-client relationship exists, which can create a conflict of interest before the firm has even agreed to take the case. The Arizona State Bar publishes model language worth quoting in full, because it's the kind of thing firms either copy correctly or garble into something legally useless: "Submitting your information to us through this web form does not establish an attorney-client relationship. Information submitted through this web form is not confidential, not subject to attorney-client privilege, and will not preclude this law firm from representing a different client in the same legal matter. We do not represent you until you meet with us and sign a fee agreement. Please do not send us any confidential information about your case until we meet." That language, or something functionally identical, belongs on every intake form the site runs, not just the main "Contact Us" page.

Testimonials, case results, and specialization claims, where firms most commonly cross the line

If there's one category of content that gets firms in front of a bar review board, it's testimonials, and the reason is almost always the same: someone edited a client's words to sound punchier. Many states require any ad with a testimonial to carry language along the lines of "the testimony may not be representative of the experience of other clients," and paid endorsements or spokespeople need clear labeling as such.

Editing a client quote for polish is not a gray area, it's a documented trigger for enforcement. A Florida personal injury firm found this out in 2024, after a state bar review of edited client testimonials on its website and in Facebook ads forced it to strip every modified quote, rewrite its ad copy, and add outcome disclaimers across every channel it used. Florida in particular draws a hard line around "five-star outcome" language and phrases like "won my case." A review of 47 Florida law firm websites across personal injury, med mal, criminal defense, and family law found multiple firms running both anyway.

Case results carry a parallel risk. Many states prohibit statements that could hand a prospective client unjustified expectations about their own outcome, and where results are allowed at all, a disclaimer that past results don't guarantee future ones is required, and it can't be buried in six-point font at the bottom of the page. That disclaimer follows the result everywhere it appears: on the website, in a Google Ad, in a Facebook campaign, on a legal directory profile.

Specialization claims are their own trap, and Texas draws the clearest line of any state on this point. Rule 7.04(b)(2) of the Texas Disciplinary Rules bars an attorney from claiming special competence, certification, or specialization unless it's true, and truth here has a specific technical meaning: a Texas lawyer can't say "specialize" or "certified" in a practice area without holding an actual Certificate of Special Competence from the Texas Board of Legal Specialization in that area. Saying you specialize in family law because you've handled two hundred divorces isn't the same thing as holding a recognized certification, and the bar treats it as a different claim.

Generic superlatives run into the same wall. "The top firm in California" or "the best criminal defense lawyers in Texas" invites scrutiny unless it's tied to a specific, named, verifiable award or ranking. Even a real accolade needs its source identified. An unnamed "award-winning" claim creates roughly the same misleading impression as no award at all, because the reader has no way to check it. Any of these three categories, botched testimonials, oversold results, unsupported specialization claims, can turn into a formal ethics complaint or a malpractice suit. Neither outcome arrives as a friendly letter.

How Florida, Texas, New York, and California diverge from the ABA baseline

Florida runs one of the strictest regimes in the country, and it starts with Rule 4-7.13(b)(8), effective since May 2013, which requires disclaimer language stating a prospective client may not get the same or similar results. Beyond that, Rule 4-7.19(a) requires most advertisements, with limited exemptions, to be filed with the bar before first use. Websites can't be filed in their entirety, but they still have to substantively comply with Florida's attorney advertising rules, and direct mail and direct email sent to prospective clients fall outside the safe-harbor exemption entirely, so they always require filing. The review of those 47 Florida firms turned up testimonials that appeared to violate bar advertising rules, firms with no bar number listed anywhere on the site, and contact forms missing required consent language, compliance gaps that carry their own separate exposure.

Texas runs advertisements through its Advertising Review Department under Part VII of the Texas Disciplinary Rules, and Rule 7.04(q) has a specific, easy-to-miss requirement: any disclaimer has to appear with the same prominence as the claim it's qualifying. A bold, oversized "results may vary" isn't the standard, and neither is a disclaimer in six-point gray font under a headline in 40-point bold. Texas also runs a 10-day ad filing window, requires four years of record retention, and generally bars false, misleading, or unsubstantiated superlative claims.

New York's rules around personal injury and wrongful death solicitations have carried a strict timing restriction: no solicitation tied to a specific incident before the 30th day after it happened, with a narrow 15-day exception when a legal filing deadline within 30 days requires it. That entire 30-day and 15-day framework is set to disappear under new rules effective June 2026. Solicitations also have to be filed with the attorney disciplinary committee covering the firm's principal office. And on December 30, 2025, New York's Office of Court Administration released proposed amendments to Rules 1.0 and 7.1 through 7.4, aiming to bring the state closer to the ABA's current advertising language. Nothing is adopted yet. No effective date exists. Comment periods and Appellate Division approvals are still pending, which means firms advertising in New York, especially in a media market of comparable size within the state, should be watching this through 2026 rather than assuming the current rules are permanent.

California, for its part, took a lighter regulatory touch when its current Rules of Professional Conduct took effect on November 1, 2018, following state Supreme Court approval that May. Rule 7.1 doesn't mandate specific disclaimer language, only noting in its comments that an appropriate disclaimer often helps avoid creating unjustified expectations, which leaves firms making a judgment call rather than following a script. State Bar Formal Ethics Opinion 2001-155 established that website marketing falls under California's advertising and solicitation rules even though the rules never name websites directly, a bit of regulatory reasoning by extension rather than explicit text. California also extends its reach into AI tooling: if a firm operates in California but its AI vendor processes data somewhere else, California's rules follow the data anyway, according to Paxton.ai's coverage of the rollout that began in January 2025.

Across these four markets, and Pennsylvania besides, where updated advertising rules took effect November 14, 2024, requiring jurisdictional disclosures for firms with offices in more than one state, no single disclaimer block covers everyone. Firms operating across state lines need something closer to a compliance map than a template, because Texas wants equal-prominence disclaimers, Florida wants a 20-day filing window, and New York's whole framework might change out from under everyone within the next year or so.

Data privacy obligations that apply on top of bar rules

Bar compliance and data privacy compliance run on separate tracks, and a website can pass one while failing the other completely. A firm can nail every disclosure the state bar wants and still be out of step with the privacy laws that apply to any business collecting personal information online, law firm or not.

California's CCPA and CPRA require attorney websites to tell visitors what data gets collected, offer a "Do Not Sell My Personal Information" opt-out, and give users real control over cookies and tracking tech, along with rights to access, correct, or delete their own data. The EU's GDPR reaches further than firms sometimes expect: it applies to any law firm site that targets or collects data from EU residents, and it demands active opt-in consent before any data collection starts, not a passive notice buried in a cookie banner. Consent has to be specific about what data types are being gathered, and users need a real way to withdraw that consent later.

Firms working in personal injury, medical malpractice, or workers' compensation carry an extra layer on top of all this: HIPAA. Any protected health information that moves through a website, whether it's an intake form or an email exchange, has to meet HIPAA's data handling standards, which sit entirely outside what any bar association regulates. A firm can be in perfect standing with its state bar and still be exposed to an FTC enforcement action or a civil suit over how it handles health data. That's the real shape of the problem this whole piece has been circling: bar compliance is one layer, not the whole building. Get the ABA baseline right, add the state-specific rules on top, and then check that the privacy and accessibility obligations sitting outside bar jurisdiction entirely are covered too. Skip any one layer, and the other two won't save the firm from the layer it ignored.