Pillar guide

Small Law Firm Marketing With AI: A Complete Guide That Keeps Client Data Out

Small law firm marketing with AI, tactic by tactic: website, reviews, email, social, SEO and budget, each checked against confidentiality and advertising rules.

Written by Miriad with AI assistance and checked line by line against the sources at the end. This is a guide to marketing and office practice, not legal or ethics advice: your state bar's rules decide.

TL;DR: Most small law firm marketing does not need client data at all, which is why AI can help without breaking confidentiality. Keep client matters out of public AI tools, verify every output, and check each piece against the advertising rules on misleading claims, specialist titles, contact details and solicitation. Build on referrals, a clear website, an honest Google profile and steady email, in that order.

A two-lawyer firm sits down on a Friday afternoon to "finally do the marketing". One partner wants to try ChatGPT for the website. The other has read about lawyers sanctioned for fake citations and says no AI, full stop. Both are reacting to a real risk, and both are mixing up two different kinds of work.

Legal work runs on client facts. Marketing work mostly does not. A practice area page, a newsletter about a rule change, a reply to a Google review, a month of social posts: none of these need a client's name, file or story, and most of them are better without one. Once you separate the two, the question shifts from "can we use AI?" to "which inputs are we allowed to give it, and who checks what comes out?"

This guide goes tactic by tactic, and every tactic is checked against confidentiality first, then against the attorney advertising rules. Each section links to a shorter article that goes deeper on one task.

Why do small firms hesitate to use AI for marketing?

Small firms hesitate because the duty of confidentiality is personal to the lawyer, and the public AI tools are new and opaque. Surveys show adoption rising but ethical concerns staying high. The hesitation is reasonable for legal work; for marketing work it is mostly solved by keeping client information out of the prompt.

The numbers show a profession split down the middle. Smokeball's 2025 State of Law report, covering 310 respondents, found that 53% of small firms and solos now use generative AI in their workflows, up from 27% in 2023, and that 53% still have ethical concerns (LawNext, 2025). Clio's 2025 report on solo and small firms, as covered by the press, describes solos and small firms as lagging behind larger firms on AI (Canadian Lawyer, 2025).

The fear has a famous case behind it. In Mata v. Avianca the court sanctioned lawyers who filed briefs with case citations ChatGPT had invented, and imposed a $5,000 penalty (Opinion and Order on Sanctions, 2023). Read the order, though, and the court says there is "nothing inherently improper" about using a reliable AI tool. The failure was not checking the output. That distinction matters for marketing too: hallucinated citations in a blog post will not lead to Rule 11 sanctions, but they will mislead readers, and misleading communications are exactly what the advertising rules prohibit.

So the useful starting point is not "AI or no AI". It is two questions you can answer for every task: does this task need client information, and who reviews the result before it goes public?

What does the confidentiality line look like for marketing work?

The confidentiality line for marketing is simple: no client-specific information goes into a public AI tool, and the output is reviewed by a lawyer before publication. Bar guidance from the ABA, California, North Carolina and the European bars all points the same way, even though the exact wording differs by jurisdiction.

Here is what the main opinions say, in plain terms:

  • ABA Formal Opinion 512 (issued 29 July 2024) says general boilerplate in an engagement letter is not enough as informed consent to put client data into self-learning tools, and it expects firm managers to set clear GenAI policies for lawyers and staff (National Law Review summary, 2024).
  • California's 2026 guidance says a lawyer must not input confidential client information into a tool with material confidentiality or security risks without informed client consent, and that a vendor's "generalized marketing assurances" are not enough (State Bar of California, 2026).
  • North Carolina's 2024 FEO 1 says lawyers should avoid putting client-specific information into publicly available AI resources (North Carolina State Bar, 2024).
  • The CCBE guide for European lawyers says not to enter personal or confidential client data without appropriate safeguards, and to verify outputs before use (CCBE, 2025).

Applied to marketing, the table below is how we sort tasks in practice. The point is that most of the right-hand column is "no".

Marketing task Needs client information? What to watch
Practice area page No Misleading claims, specialist wording
Newsletter on a rule change No Accuracy of the legal summary
Reply to a Google review No, and it must not reveal any The reply is public
Case study or "recent result" Yes, so usually avoid Confidentiality and unjustified expectations
Social post No Solicitation, testimonials
Intake form copy No, but the form collects it Where the form data is stored

If you want this as a sheet to pin up in the office, we wrote what you can put into ChatGPT as a lawyer, and what you can't. If you want it as a firm rule, start with the one-page law firm AI policy template.

Where do a small firm's clients actually come from?

For most small firms, new clients still come from referrals first, then from search, the Google profile and the website. Marketing should therefore support the referral path rather than replace it: make the firm easy to find, easy to check and easy to contact once someone has heard your name.

Both large practice-management surveys agree on referrals. Clio's 2025 solo and small firm report, as reported, defines solo and small as five or fewer full-time employees and finds that 59% name referrals as their top lead source (Canadian Lawyer, 2025). Smokeball's survey puts referrals as the primary growth channel for 85%, while 43% call digital marketing key, 21% struggle with it and 20% do no marketing at all (LawNext, 2025).

The typical path a prospective client takes looks like this. It is our synthesis of the sources, not a single study:

  1. A referral from a past client, another lawyer or a friend, or a search.
  2. A look at the Google Business Profile and its reviews.
  3. A visit to the website, usually to one practice area page.
  4. A call or an intake form, followed by a conflict check.
  5. An engagement letter, which is also where any AI-use consent belongs.
  6. The matter itself.

Each step is a place where a small firm can lose someone who was already halfway in. That is the logic behind the law firm marketing ideas that fit a solo or small practice: fix the leaks on the path before buying more traffic. It is also why the law firm marketing budget article starts from intake capacity, not from a percentage of revenue.

How should a small firm's website be structured and written?

A small firm's website should be built around practice area pages and a clear intake path, not around a design trend. Every page has to meet the advertising rules: no misleading statements, a named responsible lawyer with contact details, and no specialist claim unless the certifying organisation is named.

Structure first. A solo with one practice area needs a strong home page, one deep practice page, an about page with the lawyer's admissions, and an intake page. A small firm with four practice areas needs a page per area, written for the questions a prospective client in that area actually asks. We compare the layouts in law firm website templates: which structure fits a small practice.

Then the words. The advertising rules are short, but they bite on websites. Using Minnesota's text as a fetchable state version of the ABA Model Rules structure:

  • Rule 7.1 treats a truthful statement as potentially misleading if, for example, it reports past results in a way that creates an unjustified expectation for other clients (Minn. R. Prof. Conduct 7.1, accessed 2026).
  • Rule 7.2 requires a "specialist" or "certified" claim to name the certifying organisation, and every communication to include at least one responsible lawyer or firm with contact details (Minn. R. Prof. Conduct 7.2, accessed 2026).

Your state's version may differ in wording, and some states add their own requirements, so check your state bar's text before you publish. The practical writing method, including how to answer "what will happen in my case?" without implying an outcome, is in law firm website content writing: practice area pages without promising outcomes.

AI can draft these pages well, because the input is your knowledge of the practice area, not a client file. 8am lists blog drafts, About pages, translated web pages, newsletters and social posts among marketing uses for law firms, with a warning not to put sensitive client data into consumer-grade tools (8am, 2025). The lawyer still reads every line before it goes live, because the duty is the lawyer's, not the tool's.

How do reviews and the Google Business Profile fit the rules?

Reviews and the Google Business Profile fit the rules if you ask every client the same way, never pay or reward a review, never fake one, and reply without revealing anything about the matter. Google and the FTC set the platform rules; your confidentiality duty sets the limit on what a reply can say.

Google treats lawyers as individual practitioners: each lawyer may have a profile, but a lawyer should not create several profiles for different specialisations, and the business name should not carry extra marketing words (Google Business Profile guidelines, accessed 2026). On reviews, Google prohibits incentives and selective solicitation of positive reviews (Google prohibited content, accessed 2026). The FTC's final rule, announced in August 2024, bans fake reviews including AI-generated ones, incentives tied to positive or negative sentiment, undisclosed insider reviews and suppressing reviews through threats (FTC, 2024).

Why it matters now: BrightLocal's 2025 survey of 1,026 US consumers across all industries found that 48% read AI-generated review summaries before reading individual reviews (BrightLocal, 2025). That figure is not specific to lawyers, but it means the overall tone of your reviews may be summarised for a prospective client before they read a single one.

Example (illustrative, not a real case): A solo family lawyer gets a one-star review from a former client's ex-spouse, describing the divorce as unfair. The lawyer asks an AI tool for a short, polite reply and gives it no facts at all: only "a negative review about a family law matter, reply without confirming any relationship or detail". The draft thanks the reviewer for the feedback, says the firm cannot discuss any matter publicly and gives the office phone number. The lawyer checks it, removes one sentence that sounded defensive, and posts it. Google shows replies publicly as the business, and the reviewer is notified and can still change the review (Google, manage reviews, accessed 2026). The lawyer does not threaten the reviewer or ask Google to remove the review for being unfair, because suppressing reviews by threat is exactly what the FTC rule targets.

If you also run Local Services Ads, Google screens lawyers before ads go live, including a state bar licence check for each lawyer in the firm and professional liability insurance where local law applies (Google Local Services screening, accessed 2026).

What can email and social media do without touching a client matter?

Email and social media work well for small firms when the content comes from changes in the law, common questions and the firm's own process, not from client stories. A newsletter or post written that way needs no confidential input, stays clear of solicitation rules and gives referral sources something to forward.

On solicitation, Rule 7.3 bars live person-to-person solicitation for pecuniary gain, but websites and ads are generally not solicitation, and texts or chat messages are not "live" contact (Minn. R. Prof. Conduct 7.3, accessed 2026). A newsletter is still a communication about your services, so the Rule 7.1 and 7.2 points above apply to it: no misleading claims, and a responsible lawyer with contact details.

The safest raw material is public. A new statute, a court rule change, a filing deadline that catches people out, a form that changed: each is a short, useful update that does not depend on any client. Our email marketing for a law firm article shows how to turn one legal change into an update in under an hour, and how to build the list without paying for referrals.

Social media follows the same logic, with one extra trap: a "story from this week" can identify a client even without a name, especially in a small town or a narrow practice area. The law firm social media post ideas article gives a month of posts, each with its confidentiality and advertising check written next to it.

Example (illustrative, not a real case): A two-lawyer estate-planning firm with one assistant writes a one-page AI rule before anyone drafts a newsletter. It says that client data never goes into a public AI tool, that a lawyer reviews every output and checks every citation, and that the engagement letter gives clients a specific explanation of any AI use on their matter instead of a boilerplate clause. The assistant now drafts the monthly update from a public probate rule change, the partner reviews it, and nobody has to ask whether a client file was pasted somewhere. The structure of that rule follows ABA Opinion 512, North Carolina's FEO 1 and California's guidance, and the verification step comes from Mata.

Should a small firm hire an SEO specialist or keep it in-house?

A small firm should decide on SEO help by asking who signs off on legal accuracy, not by price first. An agency can handle technical work and drafting, but a lawyer must approve every statement of law and every claim about the firm, because the advertising duty stays with the lawyer.

Law firm SEO is a crowded market, and we did not find a reliable public source on what it typically costs, so we will not quote a range. What we can say is what the rules imply. Payments to an agency for advertising are allowed; payments for recommending your services generally are not, with exceptions such as advertising costs and qualified referral services (Minn. R. Prof. Conduct 7.2, accessed 2026). If a vendor's model looks like paying per referred client, read your state's version of that rule before you sign.

In-house SEO for a small firm is realistic when the lawyer can spend a little time each week reviewing drafts, and someone in the office can publish and update pages. The law firm SEO specialist or in-house article lists the questions to ask an agency, including who writes, who checks the law, and what happens to the content if you part ways.

One thing does not change with either option: the content has to be accurate. Search engines and AI assistants both read your pages, and a page that misstates a deadline is worse than no page.

How do you turn all this into a plan you will actually run?

You turn this into a plan by picking three or four channels, giving each a weekly time slot and an owner, and writing down the rule check that applies to each. A plan a small firm runs for a year beats a larger plan dropped in March. Start with the AI policy, then the website, then reviews.

The plan has to fit the firm's capacity. Clio's report, as covered, puts average utilization at 27% for solos and 32% for small firms, compared with about 50% at mid-sized firms, and says 15% offer flat fees (Canadian Lawyer, 2025). Low utilization does not automatically mean "do more marketing"; it can also mean intake, billing or admin is eating the day. That is why we size marketing against how many new matters the firm can actually take.

A few rules affect the plan's economics:

So AI tools for marketing belong in the firm's own budget, and the learning time is the firm's own time. For firms in the EU, the AI Act's AI-literacy duty has applied since 2 February 2025 to deployers, which includes law firms using AI (EU AI Act, Article 4); a short internal briefing on the AI policy is a sensible way to meet it.

For a worked version with realistic hours, see the law firm marketing plan example. For the money side, the law firm marketing budget article gives a decision method based on case value and intake capacity.

Read the articles in the order your firm needs them: the AI rules first if staff are already using ChatGPT, the website articles if your site is thin, and the plan and budget articles if you are starting from nothing. Each one is a single task, written for a firm of two to ten people.

All articles for this industry are listed on the law firm (solo / small) page.

If you want your AI tools to start from the firm's own facts (practice areas, fee structure, the words your clients use, the AI rules you just wrote) instead of a blank prompt, that is what the Business Brain Starter Kit is for. Get notified when it launches.

FAQ

Is it ethical for a small law firm to use AI for marketing?

Bar guidance does not forbid it. The ethics opinions focus on confidentiality, competence, verification and billing. Marketing tasks such as drafting a practice area page or a newsletter rarely need client information, so the main duties are to keep client data out of public tools, check every output, and make sure the result meets your state's advertising rules before it is published.

Can I put client information into ChatGPT to write a case study?

Generally you should not. North Carolina says to avoid client-specific information in publicly available AI tools, and ABA Opinion 512 says boilerplate engagement letter language is not informed consent for self-learning tools. A case study also raises the advertising problem of past results creating unjustified expectations. Write about the type of matter and your process instead of a specific client.

Do the attorney advertising rules apply to my website and newsletter?

Yes. A website and a newsletter are communications about your services, so the rules on false or misleading statements apply, and in states following the Model Rules structure, so do the rules on naming a responsible lawyer with contact details and on specialist claims. Websites and ads are generally not solicitation, which covers live person-to-person contact. Check your own state's text, because the wording varies.

Can I offer clients a discount or gift for leaving a Google review?

No. Google prohibits incentives for reviews and selective solicitation of positive ones, and the FTC rule bans incentives tied to positive or negative sentiment. Ask every client the same way, at the same point in the matter, with no reward attached. Separately, many state rules restrict giving anything of value for recommending your services, so a review reward can raise a bar issue too.

What is the first marketing task a solo lawyer should do with AI?

Write the firm's AI rule first, even if it is one page. Then use AI to redraft your strongest practice area page from your own notes, and review it against the advertising rules. Those two steps cost little, need no client data, and make every later task, from email to social posts, faster to check because the boundaries are already written down.

Should a small firm mention that it uses AI in its marketing content?

There is no single rule for marketing content in the sources we checked. North Carolina says disclosure of AI use is generally not required for ordinary tasks, while substantive delegated legal work needs informed consent. For marketing, the safer habit is to keep a short internal note of how content was made and who reviewed it, and to follow your state bar if it issues specific guidance.

Sources

Related articles

Products from Miriad

Business brainBusiness Brain Starter Kit

Stop explaining your business from scratch. Write it down once, with a source next to every line.

49 USD

Get notified

See all prompt packs