Every law firm website with a contact form, intake questionnaire, or consultation request is collecting personal data. Names. Phone numbers. Email addresses. In many cases, descriptions of legal matters that are sensitive by nature.
Most managing partners understand this in the abstract. Few, however, have asked the specific questions that matter: Where does that data go after someone hits submit? Who has access to it? How long does the firm store it? Does the transmission use encryption? And if something goes wrong, who at the firm is accountable?
The answer to that last question is almost always the managing partner.
The gap between collection and governance
Law firm websites are commonly built by one vendor, hosted by another, and maintained by no one in particular. In that environment, data governance falls through the cracks. Firms configure forms once and never revisit them. Submission data may sit in an unencrypted database, flow into a shared inbox, or land in a plugin that nobody has updated in years.
None of this is unusual. But it creates exposure that most firms have never evaluated.
The regulatory picture is expanding
Twenty states now have comprehensive consumer privacy laws in effect, including California, Texas, Colorado, Connecticut, and Virginia, with more advancing through legislative cycles. These laws impose obligations around data disclosure, consent, and handling on any organization that collects personal information online. Law firms are not exempt.
Nearly every firm’s website collects contact information through intake forms. Because of that, disclosure and consent requirements should already appear in the site’s configuration and policies. A generic privacy policy copied from a template five years ago is unlikely to meet current standards in most jurisdictions.
The ethics dimension
The ABA has addressed this directly. Formal Opinion 477R established that lawyers carry an ethical obligation to secure protected client information when communicating digitally. Formal Opinion 483 extended that guidance to cover obligations following a data breach, grounding the duty in Model Rules 1.1 (competence), 1.6 (confidentiality), and 1.15 (safeguarding client property).
The rule that should concern managing partners most, however, is one that rarely comes up in conversations about websites: Model Rule 1.18.
Rule 1.18 imposes confidentiality obligations toward prospective clients. When a law firm website invites visitors to submit information about a potential legal matter, and a visitor does so, that interaction can trigger those obligations. The individual does not need to sign an engagement letter or pay a retainer. The website’s invitation, combined with the visitor’s response, may be sufficient.
As a result, an intake form on an unsecured website is not simply a data governance gap. It is a potential ethics issue involving people who are not yet clients but whose information the firm is already obligated to protect.
What responsible firms do differently
Firms that handle this well share several characteristics. First, they know exactly what data their website collects and where it goes. Second, they use encrypted transmission for all form submissions. Third, they limit access to submission data to the people who need it. Finally, they have someone, whether internal or external, who holds specific accountability for the site’s security posture and reviews privacy disclosures on a regular basis.
Firms that handle it poorly tend to share one characteristic: nobody has ever asked these questions.
The managing partner’s role
This does not need to become a permanent item on the managing partner’s desk. It does, however, need to originate there. Someone at the firm must be accountable for understanding what the website collects, how the firm protects it, and whether current practices meet the firm’s obligations.
That accountability starts with visibility. You cannot govern what you have not examined.
Not sure where your firm stands? StateWP offers a free performance and security audit for MPF members. Request yours here.