WhatsApp for law firms: state bar ethics, confidentiality and bot without improper solicitation

Clients want to reach the lawyer on WhatsApp. The lawyer wants to respond fast. But state bar ethics rules + ABA Model Rules of Professional Conduct (especially Rule 1.6 on confidentiality and Rules 7.1-7.3 on advertising and solicitation) + privacy laws covering sensitive case data form a minefield: a poorly configured bot turns into improper solicitation or breach of attorney-client privilege. This playbook is the protocol that keeps your firm inside the lines without losing speed.

⚠️ Disclaimer: this content is informational only. It does not substitute consultation with an ethics counsel or your local state bar. Each jurisdiction may have its own interpretations.

The 3 ethics rules that matter for WhatsApp

1. Confidentiality (ABA Model Rule 1.6)

All communication with a client is confidential. This impacts WhatsApp on 3 practical fronts:

• No screenshots in the team group without care — a screenshot can leak a name, fact, or case number.
• Do not share the client's WhatsApp number with third parties without authorization (referral, co-counsel).
• Use the official Cloud API, not the regular WhatsApp app on a personal phone — separates professional/personal and keeps an auditable history.

2. Advertising and solicitation (ABA Model Rules 7.1-7.3)

The bar permits truthful and non-misleading advertising. It prohibits:

• Result-based guarantees ("guaranteed win", "100% success").
• Unverifiable comparisons with colleagues ("best lawyer in X").
• Live solicitation via WhatsApp to a prospect with whom you have no prior relationship.
• Mass messages to a contact list without proper professional opt-in.

Allowed:

• Replying to a client who wrote first.
• Sending case updates to an existing client.
• Informational communication (hearing reminder, filing attachment).

3. Sensitive data (privacy laws)

Litigation data is often sensitive personal data (involving health, race, politics, union activity, etc. in many cases). Processing requires a specific legal basis + heightened security care under GDPR/CCPA/LGPD and similar frameworks.

Bot setup inside the rules

What the bot CAN do

• Identify the client: ask for name + ID, validate against the firm's database.
• Schedule a consultation: show available slots, book.
• Confirm a hearing: "Reminder: hearing tomorrow at 2pm at the SDNY courthouse".
• Collect a document: "Feel free to send a photo/PDF of your ID here".
• Generic status: "Case is in discovery, next step X on date Y".
• Initial triage: "Is this a new matter or an existing client?".

What the bot MUST NOT do (HAND OFF TO LAWYER)

• Give legal advice ("you'll win your case", "80% chance").
• Discuss case merits or strategy.
• Negotiate complex fees (fixed table OK; case-by-case only with the lawyer).
• Answer a specific legal question ("can I sue my neighbor?").

HSM templates by category

Consultation confirmation

Name: consultation_confirmed
Category: UTILITY

Hi {{1}}, your consultation with {{2}}, Esq. is confirmed
for {{3}} at {{4}}.

Address: {{5}}
Documents to bring: {{6}}

To reschedule, reply RESCHEDULE.
Attorney: {{7}}, Bar No. {{8}} ({{9}}).

Note the bar registration in the footer — this addresses Model Rule 7.2(d) (mandatory attorney identification in communications).

Hearing reminder

Name: hearing_reminder
Category: UTILITY

Reminder: you have a hearing tomorrow, {{1}}, at {{2}},
at the {{3}} courthouse, Room {{4}}.

Arrive 30 min early. Bring photo ID.

Any questions, reach out to us here.
Attorney: {{5}}, Bar No. {{6}} ({{7}}).

Critical conduct during intake

When a client writes "can I sue X?"

Bot: "To give that assessment, the responsible attorney needs to review the facts. May I schedule a consultation? I have slots available this week."

Never guess at the answer. Even when it seems obvious.

When a client asks for a status update on a confidential matter

Bot: "I'll have the responsible attorney get back to you on the next business day. I can help in the meantime: do you want to know about a deadline, next steps, or a specific hearing?"

Never provide specific merits details by bot — even info that seems routine may be strategic.

When someone asks about the fee schedule

Bot can say: "Our fees follow the state bar minimum schedule. Initial consultations are $X. Each matter has a custom proposal prepared by the attorney after the consultation."

No discounts via bot, no bargaining. Fees are the lawyer's territory.

Technical privacy

• Official WhatsApp Cloud API — auditable log, not the regular phone app.
• BSP platform with regional data hosting — privacy compliance + appropriate jurisdiction.
• Access by the responsible attorney only — only those on the matter see the conversation.
• Retention: indefinite — statutes of limitation run 10+ years; keep the full history.
• Encrypted backup — periodic, before any reinstall or platform switch.

Outbound contact: the real limit

The firm can send an outbound message to:

• Current client (with an active retainer) — case updates, reminders.
• Former client (with a closed matter) — institutional relationship messaging, but NOT an unsolicited new service pitch.
• Lead who filled in a website form requesting contact.

NOT allowed:

• Buying a list of "people who got social security awards" and pitching them.
• Cold message to a contact found on a professional list.
• Reactivating a former client by pitching a "new benefit" available.

What your state bar may ask during a review

• Proof of opt-in for any outbound send.
• The exact text of the HSM templates used (no guarantees, no comparisons).
• Attorney identification visible in the communication.
• Public privacy policy.
• Proof of lawful basis for processing sensitive data.

When NOT to use WhatsApp

• Official process service — service of process, formal notices, pleadings. Use the court system + clerk.
• Sensitive merits discussion — criminal matter, sealed case. In-person meeting or phone call.
• Complex settlement negotiation — risk of client screenshotting out of context.