Retargeting for Law Firms: Privacy and Ethics Questions to Resolve Before You Launch
Retargeting legal prospects raises privacy and bar-rule questions. Here's what law firms should resolve on audiences, creative, and exclusions first.
Before your firm retargets anyone, settle five questions: which pages the audience comes from, what that history reveals about the visitor, which platform rules apply to that kind of matter, what data the tag actually sends, and whether the ad would make someone feel watched. For law firms across the U.S., retargeting is a governance decision first and a campaign setting second. Some campaigns should launch with tight limits, some need counsel’s review, and some shouldn’t run at all.
This guide is a launch review, not a setup tutorial. It walks through each decision gate, marks where your ethics and privacy counsel must weigh in, and ends with when skipping retargeting is the better call. It isn’t legal advice, and the rules that bind your firm are your state’s, not the ABA’s model versions.
Here’s the moment this article is for. The firm’s marketing lead has a new campaign plan on the table. The website already has an ads tag installed. Someone suggests building an audience of everyone who visited the divorce page, or the bankruptcy page, or the criminal defense page in the last thirty days, and showing them ads around the web. It’s a standard tactic in most industries. The plan is two clicks from launch.
In legal marketing, that plan deserves a pause. The audience isn’t “people interested in our firm.” It’s “people who looked up help with a divorce,” which is a different and more sensitive thing to hold, target, and advertise to.
Before retargeting, what does your visitor’s page history reveal?
A retargeting audience is defined by behavior: who visited which page. On most business websites, that behavior says little about the visitor. On a law firm’s site, the page itself can reveal the visitor’s situation. Someone who spent five minutes on your bankruptcy page or your protective-order page has told you something personal, whether or not they ever contact you.
The FTC’s consumer guidance on how websites and apps collect and use your information explains that sites use cookies, pixels, and similar technologies to track browsing activity, including for personalized ads. That’s the mechanism retargeting runs on. When the browsing activity is “looked at a legal-help page about my divorce,” the tag is recording something sensitive about a real person.
So the first gate isn’t a platform setting. It’s a site map. List every page you’re considering as an audience source and ask, page by page, what a visit implies about the person.
Low-signal pages
Homepage, attorney bios, firm history, general contact pages. A visit says little about the visitor’s personal situation.
Practice-area pages
A visit can suggest the visitor, or someone close to them, faces a specific legal problem. Review before using as an audience source.
Intake and case pages
Forms, case evaluations, and confirmation pages can reveal the most. These are the strongest candidates for excluding from tags entirely.
Personal injury, family law, bankruptcy, and criminal defense pages are illustrations, not a rule. The right classification depends on what each of your pages actually says and who it’s written for. That’s a judgment your team and counsel should make together, once, and document.
Which legal-service audiences can trigger Google’s sensitive-interest restrictions?
Google Ads has a personalized advertising policy that restricts advertisers from using curated audiences, such as remarketing lists, for ads in certain sensitive-interest categories. The categories Google lists include personal hardships such as abuse or trauma, negative financial status, relationship hardships, and commission of crime.
Read that list as a law firm marketer and several practice areas sit close to it. We can’t tell you how Google classifies a given campaign; that depends on the ad, the landing page, and Google’s review. What we can tell you is which questions to ask before you build the audience.
| Practice area (illustrative) | Google sensitive category it may sit near | Question to resolve before launch |
|---|---|---|
| Family law | Relationship hardships | Does an audience built from divorce or custody pages fall under Google’s restriction for this campaign? |
| Bankruptcy and debt | Negative financial status | Would remarketing to visitors of these pages be treated as targeting people in financial hardship? |
| Criminal defense | Commission of crime | Does the ad or audience imply the viewer may have been accused of a crime? |
| Abuse and protective orders | Personal hardships, including abuse or trauma | Should these pages be excluded from all audience-building, regardless of campaign? |
| Personal injury | Depends on page content and ad | Does the specific page or creative reference trauma or hardship in a way the policy covers? |
Two cautions. First, a campaign being approved or a tag firing doesn’t mean the audience is permitted. Policy enforcement and campaign approval are not the same thing as a policy review your firm did on purpose. Second, Google updates these policies. Check the current version on the day you launch, not the version someone read last year.
Don’t engineer around the restriction. Renaming an audience, moving a sensitive page to a different URL, or blending lists so the source is less obvious doesn’t change what the audience is. If a page’s visitors fall into a restricted category, the honest answers are to exclude them or skip personalized targeting for that practice area.
What data would your pixel, list, or CRM actually share?
Retargeting usually involves more systems than people realize: the ads tag on the website, a tag manager, the ad platforms themselves, sometimes an intake form tool, and sometimes a CRM that syncs contact lists. Each connection is a place where data can leave the firm.
Google’s policies set two lines that matter here. Its personalized advertising policy prohibits combining personally identifiable information with anonymous or pseudonymous audience data, and prohibits passing PII to Google through remarketing tags or product data feeds. And its rules on using data for personalized ads restrict how first- and third-party audience data is used, including not sharing remarketing lists between unrelated clients.
That second point matters if an agency manages several firms in one account structure. Each firm’s audiences belong to that firm. They don’t get pooled, borrowed, or combined, no matter how similar the practice areas look.
- Which pages carry the ads tag? List them. Confirm intake forms, case-evaluation pages, and thank-you pages are handled deliberately, not by default.
- What does the tag send? Page URLs can contain sensitive words. Form fields can leak into URLs or events if they’re set up carelessly. Check what actually leaves the site.
- Is any contact list uploaded? If the firm uploads emails or phone numbers for matching, who approved it, and do those people include clients or prospective clients?
- Who has access? Know which people and vendors can see audiences, lists, and tag settings.
- What does your privacy notice say? Your site’s disclosures should match what your tags actually do. Have privacy counsel confirm.
The ABA’s model confidentiality rule is relevant context here. Model Rule 1.6 generally protects information relating to a client’s representation and calls for reasonable efforts to prevent its unauthorized disclosure. How that applies to prospective clients, website data, and ad platforms in your state is a question for your ethics counsel, which is exactly why this review needs an attorney in it, not only a marketer.
One thing we’d steer firms away from: assuming HIPAA is the governing privacy rule for a law firm’s marketing data. It isn’t the default frame for most firms, and leaning on it can lead you to check the wrong boxes. Ask your counsel which privacy and consent rules actually apply to your firm and your states.
Could the ad imply you know the visitor needs legal help?
Even with a defensible audience and clean data, the creative can create its own problem. Picture someone who read a divorce page on a shared family computer seeing an ad that says “Still thinking about divorce? We can help.” The ad has just told everyone in the room what that person was researching.
Meta’s advertising standards include a rule on personal attributes: advertisers may not assert or imply personal attributes of the person viewing the ad. Ads that speak to the viewer as if the advertiser knows their situation are the classic example. Google’s restrictions on sensitive categories point the same direction. Platform policies change, so confirm the current wording of each before launch.
Creative that implies knowledge
“Facing bankruptcy?” “Did you get arrested this weekend?” “Your divorce doesn’t have to be a fight.” Each speaks to the viewer as if the firm knows their situation.
Creative that describes the firm
“Family law guidance from attorneys who explain your options.” “Questions about the bankruptcy process? Read our guide.” Each describes what the firm offers without asserting anything about the viewer.
Attorney-advertising rules add another layer. ABA Model Rule 7.1 bars a lawyer from false or misleading statements about their services, and a retargeting ad is one of those statements, as is the page it lands on. Model Rule 7.3 defines solicitation and prohibits certain approaches, including those involving coercion, duress, or harassment. Whether a particular retargeting ad counts as solicitation, or crosses any line in your state, is a question for your ethics counsel. The point here is that ad frequency and tone matter. An ad that follows a vulnerable person around the web, day after day, is worth a hard look.
The decision gates in this article rely on ABA Model Rules 1.6, 7.1, and 7.3, Google Ads’ personalized advertising and data-use policies, Meta’s advertising standards on personal attributes, and the FTC’s consumer guidance on website tracking. The ABA rules are models; your state’s adopted rules govern your firm. Platform policies change often, so confirm the current versions with the platforms and your counsel on the day you launch.
Which attorney-advertising and privacy reviews must happen before launch?
A common gap is that no one owns the decision. Marketing assumes counsel looked at it. Counsel assumes it’s a routine ad setting. The agency assumes the firm approved everything when it approved the budget. A launch review fixes that by naming who signs what.
| Gate | Question | Who decides | If the answer is no |
|---|---|---|---|
| 1. Page sources | Have we classified every page feeding the audience by what a visit reveals? | Marketing lead with attorney input | Stop until classified. |
| 2. Sensitive categories | Does any audience sit near a Google sensitive-interest category, and have we checked the current policy? | Marketing lead; counsel for close calls | Exclude those pages or skip personalized targeting. |
| 3. Data flow | Do we know what each tag, list, and integration sends, and is no PII passed through tags? | Technical owner; privacy counsel | Stop until audited. |
| 4. List separation | Are this firm’s audiences used only for this firm? | Agency or account owner | Stop. Separate them. |
| 5. Creative | Does any ad assert or imply the viewer’s situation? | Marketing lead; ethics counsel | Rewrite before launch. |
| 6. Bar rules | Has counsel reviewed the copy, landing page, and frequency against our state’s rules? | Ethics counsel | Hold until reviewed. |
| 7. Alternative | Would a non-personalized approach or better intake follow-up serve the goal with less risk? | Partner responsible for marketing | Choose the alternative. |
The last gate is the one firms skip. It’s also the one that most often changes the decision. If you can’t answer the first six cleanly, the seventh question is usually where you end up anyway.
Classify every page that could feed an audience.
Confirm current Google and Meta rules for each audience.
Document what every tag, list, and integration sends.
Counsel reviews ads, landing pages, and frequency.
A named partner approves, with a recheck date set.
What people get wrong about AI discovery and retargeting
As more prospective clients research legal questions through Google’s AI Overviews and AI Mode, firms are hearing two opposite claims: that AI search makes retargeting more important, because people “disappear” after reading an AI answer, or that it makes retargeting obsolete. Both skip over what Google actually says, and both can push a firm toward the wrong decision.
- “AI search visitors are a separate audience to chase.” Google says traffic from AI features is included in your overall Search Console data, within the Performance report’s Web search type. People who reach your site from an AI Overview land on the same pages as anyone else, and the same sensitivity questions apply to them.
- “Retargeting makes up for pages that don’t answer the question.” If a prospective client leaves your bankruptcy page without the answer they came for, an ad following them doesn’t fix that. A clearer page does, and it raises no privacy questions.
- “We need special AI markup to be found.” Google says there are no additional requirements or special optimizations to appear in AI Overviews or AI Mode, and no new AI text files or markup are needed. The same SEO fundamentals apply.
- “Vaguer pages are safer for privacy.” Watering down practice pages so they reveal less about visitors also makes them less useful. The privacy fix belongs in your tags and audience rules, not in weaker content.
- “An AI Overview mention is a lead source we can count on.” Google itself says no page is guaranteed to be shown. Plan intake around what you control.
For many firms, the better investment is the one that needs no tracking at all: practice pages that answer real questions accurately, and intake that responds quickly to people who do reach out. That’s the part we build through Megaphone, our publishing system, which splits the work between AI-assisted structure (about 40 percent) and human strategy (about 60 percent). In legal content, the human layer is where questions like “should this page feed an ad audience at all?” get asked.
When should your firm skip retargeting and choose another route?
Skipping retargeting isn’t a failure of marketing ambition. For some practice areas and some firms, it’s the most defensible decision available. Here’s when we’d recommend it.
The audience would come mainly from pages in or near a sensitive category, the data flow can’t be fully documented, counsel hasn’t reviewed it, or the only creative that “works” is creative that implies the viewer’s situation.
Routes to consider instead
- Improve intake follow-up for people who already contacted the firm, with counsel’s input on what’s appropriate.
- Strengthen practice pages so visitors get what they need on the first visit.
- Use advertising that doesn’t depend on a personal browsing history, after checking current platform policies.
- Retarget only from low-signal pages such as the homepage or attorney bios, if counsel agrees that’s appropriate.
- Revisit the decision later, once the review gates can be answered cleanly.
We’d treat retargeting as something a campaign has to earn, not a default setting. If a campaign can’t pass the gates above, the money is usually better spent on the parts of the funnel that don’t follow anyone around: the page, the intake call, and the follow-up.
That connects to how we look at law firm marketing in general. The useful measures are consultations, signed cases, and where prospects drop out of intake, not impressions on a retargeting campaign. A retargeting plan that adds risk without improving those numbers isn’t worth running.
Limits we hold ourselves to
We won’t tell you retargeting is legal for your firm, or that a given setup is compliant. That’s a determination for your ethics and privacy counsel, applied to your state’s rules, your practice areas, and your actual data flows.
We won’t promise that retargeting, or skipping it, will change your caseload, cost per lead, or return by any amount.
We won’t suggest workarounds to platform restrictions, and we won’t pool audiences across firms.
And we won’t treat a platform approval as a policy decision. An approved campaign can still be the wrong campaign. If you’d like to see the wider website, content, and search work we do for firms, our services page lays it out.
Frequently asked questions
Can we retarget people who visited a divorce or bankruptcy page?
Be very cautious. Google restricts curated audiences in sensitive categories that include relationship hardships and negative financial status, and the ad itself could imply the viewer’s situation. Check the current Google and Meta policies and have counsel review before using those pages as audience sources.
Are all law firm website visitors eligible for a remarketing audience?
No. Whether an audience is allowed depends on the pages it comes from, the ad category, and current platform policy. A tag firing on every page doesn’t mean every visitor can be targeted. Classify your pages and exclude the sensitive ones deliberately.
Can an agency reuse a remarketing audience from a different law firm client?
No. Google’s data-use rules restrict sharing remarketing lists between unrelated clients. Each firm’s audiences should be built and used only for that firm.
Does an ad platform’s approval mean the campaign meets our state bar rules?
No. Platform approval is about the platform’s own policies. Compliance of your ads, landing pages, and targeting with your state’s attorney-advertising and confidentiality rules is a separate review your ethics counsel should do.
Is HIPAA the main privacy rule for every law firm?
Don’t assume so. HIPAA isn’t the default frame for most firms’ marketing data. Ask your privacy counsel which privacy, consent, and confidentiality rules actually apply to your firm in the states where you operate.
What should we do if personalized retargeting isn’t suitable?
Put the effort into practice pages that answer questions on the first visit and into intake follow-up for people who already reached out. If you still want paid visibility, consider advertising that doesn’t depend on someone’s browsing history, after checking current platform policies.
Thinking about retargeting site visitors?
Before anything launches, we can help you map which pages feed your audiences, document what your tags send, and prepare the questions your counsel needs to answer. We work with law firms across the U.S.
Explore Law Firm Marketing Services · Request Strategic Guidance · Browse Resources
Related Posts
