The Legal Marketing Infrastructure Standard

Status of this document

This is a working draft of a technical and commercial-operating standard for law firm marketing infrastructure. It is intended for review by law firms, legal marketing agencies, legal technology vendors, intake vendors, CRM providers, public directory operators, consumer-protection stakeholders, and access-to-justice organizations.

The standard does not tell firms how to market, what to spend, what practice areas to pursue, or which vendors to hire. It defines the minimum infrastructure rights and controls a law firm should retain when third parties help generate, capture, route, or analyze legal demand.

This is not a certification claim. FlowLegal products are works in progress against this standard and are not represented as certified or fully conforming.

Commercial disclosure

FlowLegal Partners LLC is the technical author of this working draft and operates FlowCounsel Growth, FlowLawyers, and related infrastructure designed to implement parts of this standard over time. The author has a commercial interest in a market where firms own their profiles, intake records, attribution, campaign data, and CRM history. That interest is disclosed here.

This standard is not product-specific. A law firm, marketing agency, directory, CRM, website vendor, answering service, AI receptionist, analytics vendor, or intake platform can implement the requirements without using FlowLegal products.

1. Background

Law firm marketing is often discussed as creative, media buying, SEO, branding, conversion, or lead volume. Those are real concerns. They are not the full system.

The firm also needs an operating layer:

• where the profile lives
• where the intake record is created
• who owns the ad account
• who controls the tracking
• whether the firm can see retained outcomes by source
• whether the intake form survives a vendor change
• whether reviews and directory presence compound for the firm or for the vendor
• whether consumer legal need is exposed to surveillance tooling
• whether the next vendor can inherit clean data instead of starting over

The market has normalized too much dependence on non-portable infrastructure records that should remain usable by the firm across vendor relationships. Agencies may own or control ad accounts. Lead-generation companies may own forms. Directory vendors may own profiles. CRMs may own pipeline data but not public discovery. Call vendors may own phone logs. Website vendors may own the site. The firm receives reports, not an owned operating record.

This standard does not prohibit vendors from hosting, operating, or securing intake infrastructure on behalf of a firm. It prohibits vendor lock-in over the records a firm needs to understand and operate its growth system: intake records, source attribution, consent evidence, disclosure versions, routing provenance, campaign history, profile data, pipeline state, and outcome feedback. A vendor may process, route, store, and protect intake data under a defined service relationship, but the firm must retain structured access, export rights, attribution continuity, consent evidence, and a vendor-transition path, subject to consumer privacy, deletion, suppression, and retention rights.

This standard is not anti-agency. High-quality agencies, consultants, intake vendors, answering services, directories, and software providers should be able to compete on strategy, creative, media buying, local-market expertise, conversion work, service quality, and operational execution. They should not have to compete by making the firm's growth memory non-portable.

That pattern weakens firm growth and weakens consumer protection.

2. The problem this standard is designed to solve

A firm that changes vendors should not lose its marketing memory.

At minimum, the firm should retain:

• public profiles and directory identity
• ad accounts and campaign history
• intake records and source attribution
• call, form, chat, SMS, and referral provenance
• review and reputation history
• landing page and content portability
• CRM and pipeline state
• consent and disclosure records
• outcome feedback tied to retained clients, declined matters, and referred matters

If those assets live primarily inside non-portable vendor-controlled systems, the firm's growth infrastructure cannot compound across service relationships. The vendor learns. The firm rents.

3. Scope

Applies to:

• law firm websites and landing pages
• public directory profiles
• legal marketing campaigns
• paid search, local service ads, social ads, video, streaming TV, and referral campaigns
• intake forms, chat, AI chat, phone intake, SMS intake, and answering services
• marketing CRMs and pre-matter pipeline tools
• review management and reputation tooling
• attribution, analytics, reporting, and dashboarding systems
• data exports and vendor transition processes

Does not apply to:

• attorney-client legal work after representation begins, except where retained-outcome feedback is used for marketing attribution
• private legal strategy, settlement posture, privileged communications, or work product
• general brand strategy or creative choices
• media-buying tactics that do not affect ownership, portability, privacy, attribution, or intake control

3.1 Normative language

"Must", "must not", "required", "shall", and "shall not" indicate mandatory baseline requirements. "Should" indicates a recommended practice. "May" indicates an allowed implementation choice.

3.2 Conformance posture

A vendor, directory, agency, CRM, intake provider, answering service, AI receptionist, or law firm should not describe a system as conforming to this standard unless the system preserves firm-owned growth records, consent evidence, attribution continuity, export rights, and vendor-transition mechanics in production.

Public alignment, roadmap intent, or a contract clause promising "data ownership" is not conformance if the firm cannot practically export and use the operating records when it changes vendors.

A conforming implementation must make the following controls explicit and reviewable:

• who owns or controls each public profile, campaign, tracking endpoint, phone number, form, chat, and intake surface
• where each prospective-client contact is recorded
• what disclosure and consent state applies
• what source, campaign, landing page, phone line, or referral path created the inquiry
• what routing path and follow-up state applies
• what outcome state the firm recorded, where known
• what export, transfer, deletion, suppression, and retention mechanics are available
• whether AI influenced intake capture, classification, routing, summarization, or follow-up

AI may assist reception, summarization, classification, follow-up drafting, attribution analysis, and campaign recommendations. AI must not become the source of truth for consent, disclosure, routing authority, transfer rights, suppression, retention, or firm-owned record identity.

4. Baseline requirements

4.1 Firm-owned ad accounts

Paid media accounts used for firm acquisition should be owned by the firm or be transferable to the firm on request. Agencies may manage accounts, optimize campaigns, create creative, and configure tracking. They must disclose when the firm is being asked to rent an agency-owned account as the condition of service.

If a managed account cannot be transferred because of platform constraints, the vendor must disclose that limitation before the engagement begins and must provide exportable campaign history at termination.

4.2 Firm-owned intake records

Every prospective-client contact must create or update a firm-owned intake record unless the contact is spam, test traffic, or another clearly excluded non-consumer event. The record must include source, campaign, landing page or phone line, timestamp, consent state, disclosure version, routing path, follow-up state, and outcome state where known.

The intake record may be stored in a vendor system during service delivery, but the firm must have export rights in a structured format. Screenshots, PDF summaries, and aggregate reports are not sufficient.

4.3 Source-to-retainer attribution

Marketing reports should not stop at impressions, clicks, calls, form fills, or "qualified leads." The firm needs a path from source to retained outcome.

At minimum, attribution data should support:

• source and campaign
• landing page or directory page
• intake mode
• practice area
• geography
• first response time
• status transitions
• retained, declined, referred, no-response, duplicate, conflict, or disqualified outcome
• revenue or case-value band where the firm chooses to record it

Vendors should not represent lead volume as marketing performance when retained outcomes are unavailable or disconnected.

4.4 Portable profiles and reputation

Public profile data must be portable where the vendor or directory controls the factual profile record. A firm should be able to export profile fields, attorney bios, practice areas, service locations, languages, accessibility information, pro bono indicators, reviews where legally exportable, and source metadata.

Vendors may own their own directory domain and page design. They should not lock the firm out of the factual profile record or make profile continuity dependent on continued paid participation.

4.5 No surveillance on intake

Legal intake surfaces must not expose consumer-identifiable legal need to advertising networks, data brokers, retargeting systems, or third-party behavioral tracking tools.

This requirement applies to:

• form pages
• chat and AI chat
• phone intake landing pages
• SMS intake paths
• document upload paths
• legal-aid screening paths
• case-request routing pages

Marketing analytics can measure campaign performance without placing surveillance tooling inside the intake conversation itself.

Sensitive legal need must not be treated as retargeting, enrichment, lookalike, suppression-audience, or behavioral advertising data. This includes immigration, domestic violence, criminal, housing, employment retaliation, benefits, disability, trafficking, custody, protest, political-activity, and other safety-risk categories where disclosure or inference could expose the consumer to enforcement, retaliation, surveillance, economic harm, or violence.

4.6 Consent and disclosure portability

Consent records belong with the intake record. A firm must be able to prove what disclosure was shown, when consent was captured, what the consumer authorized, and which downstream recipients received the information.

Consent records should include:

• disclosure version
• timestamp
• source surface
• authorized transfer scope
• AI involvement flag where applicable
• attorney-payment disclosure where applicable
• legal-aid branch posture where applicable
• revocation or suppression state where applicable
• safe-contact preferences and contact restrictions where supplied
• sensitive-legal-need safety posture where applicable, without unnecessary narrative facts

4.7 Vendor-transition rights

A vendor exit should not destroy the firm's growth system.

Contracts and operating practice must provide, where the vendor controls the relevant data or endpoint:

• structured export of intake records
• structured export of campaign and attribution history
• profile export
• review-management export where legally available
• landing page and content export or documented ownership boundary
• forwarding or migration support for phone numbers, forms, and tracking endpoints
• deletion or suppression mechanics for data the vendor no longer needs
• portability of safe-contact preferences, contact restrictions, and suppression states tied to intake records

The standard does not require vendors to transfer proprietary software, designs, trade secrets, or internal optimization models. It requires the firm to receive its own operating records.

4.8 Review and reputation integrity

Review-generation workflows must not fabricate reviews, pressure consumers, suppress negative reviews unlawfully, or make review ownership dependent on a vendor account.

Review requests should be tied to matter or consultation outcomes only where appropriate. The system should preserve enough provenance to distinguish a real client or consultation from a marketing artifact, subject to confidentiality and professional-responsibility constraints.

4.9 AI receptionist and chat boundaries

AI receptionists, chatbots, and automated intake agents used in marketing must follow the same ownership, consent, source, and retention rules as forms and phone intake.

They must not:

• imply attorney-client relationship creation
• give legal advice outside authorized boundaries
• collect unnecessary sensitive facts before disclosure
• route consumers into paid funnels without legal-aid or pro bono consideration where relevant
• use consumer intake content for model training without separate, affirmative, revocable consent
• become the source of truth for consent, eligibility, or routing authority

4.10 Firm-side feedback loop

Marketing infrastructure should support outcome feedback from the firm back into the growth system. That feedback must be structured and privacy-aware.

Useful feedback includes:

• retained
• declined
• no contact
• referred
• conflict
• wrong practice area
• outside geography
• urgent deadline
• legal-aid appropriate
• low intent
• duplicate

The purpose is to improve routing quality, budget allocation, staffing, and consumer handoff. It is not to expose confidential strategy or privileged facts to marketing vendors.

5. Required export fields

A compliant export should include, where applicable:

• intake_id
• consumer_contact_id
• source_surface
• source_url
• source_phone
• campaign_id
• ad_account_id
• utm_source
• utm_campaign
• practice_area
• jurisdiction
• created_at
• first_response_at
• disclosure_version
• consent_state
• ai_involvement
• legal_aid_branch_posture
• safe_contact_preferences
• contact_restrictions
• sensitive_legal_need_safety_posture
• routing_path
• assigned_user
• pipeline_stage
• outcome_status
• outcome_timestamp
• referral_destination
• retention_state

The field set is intentionally operational. A firm should be able to move vendors without losing the structure needed to understand and operate its pipeline.

5.1 Export format and transition evidence

A compliant export must be structured and machine-readable. CSV, JSON, database export, documented API export, or another schema-based format may satisfy this requirement. Screenshots, PDF reports, and dashboard access alone do not.

A vendor-transition packet should include:

• export schema and field definitions
• date range covered by the export
• known excluded data categories and reasons for exclusion
• disclosure and consent version mapping
• retention, deletion, and suppression state
• phone, form, chat, tracking, domain, and landing-page endpoint ownership map
• ad-account ownership or transfer status
• open follow-up items that should not be lost during transition
• consumer privacy requests that remain active

Vendors may charge reasonable service fees for transition work when disclosed in advance. They must not use technical friction, undocumented formats, inflated transition fees, or endpoint hostage-taking to trap the firm's growth records.

6. Required audit events and conformance evidence

A compliant implementation must be able to emit or export content-minimized audit events for the controls it owns. Useful events include:

• marketing.account.ownership_recorded
• marketing.account.transfer_limitation_disclosed
• intake.record.created
• intake.record.updated
• intake.source.recorded
• intake.disclosure.presented
• intake.consent.captured
• intake.ai_involvement.recorded
• intake.no_surveillance_control.checked
• intake.safe_contact_preferences.captured
• intake.contact_restrictions.recorded
• pipeline.status.updated
• pipeline.outcome.recorded
• profile.export.generated
• campaign.export.generated
• vendor_transition.export.generated
• vendor_transition.endpoint_map.generated
• privacy.suppression.recorded
• privacy.deletion.requested
• privacy.retention.transitioned

The evidence should show that the firm can preserve and operate its growth system without exposing raw consumer narratives to a standards reviewer.

6.1 Implementation checklist

A marketing infrastructure system should not be treated as standards-ready unless it can answer "yes" to each of the following:

• The firm knows which accounts, profiles, endpoints, and records it owns or can transfer.
• Each real prospective-client contact creates or updates a firm-owned intake record.
• Intake records preserve source, campaign, landing page or phone line, disclosure, consent, routing, follow-up, and outcome state where known.
• Intake surfaces do not expose consumer-identifiable legal need to advertising surveillance or data-broker tooling.
• AI receptionists and chat tools follow the same disclosure, consent, source, retention, and export requirements as forms and phone intake.
• The firm can export operational intake and attribution records in a structured format.
• Vendor-transition rights are practical, not limited to aggregate reports or screenshots.
• Safe-contact preferences, contact restrictions, suppression states, and privacy requests survive vendor transition.
• Review and reputation workflows preserve provenance and do not fabricate or unlawfully suppress reviews.
• Firm-side feedback can improve routing and budget allocation without disclosing privileged or confidential matter facts.

7. Relationship to other standards

The Consumer Legal AI Intake Standard governs AI-assisted or AI-influenced consumer intake itself.

The Legal Lead Generation Standard governs compensated case-request distribution.

This standard governs the firm's growth infrastructure: ownership, portability, attribution, privacy, vendor transition, and CRM handoff.

Together, the standards define a healthier legal growth layer:

• consumers are not harvested through opaque funnels
• attorneys are not forced to rent access to their own market identity
• firms can own the records that make marketing compound
• public-benefit routing remains visible before monetization takes over

8. Relationship to FlowLawyers and FlowCounsel

FlowLawyers is designed to provide free public attorney and firm profiles, consumer legal information, intake, and routing. FlowLawyers may host and operate public intake infrastructure, including marketplace-style case-request access where permitted by the Legal Lead Generation Standard. The intended operating model is processor-like rather than lock-in: consent evidence, provenance packets, attribution, and firm-relevant intake records flow into a portable firm-owned operating layer. FlowCounsel Growth is designed to connect intake, CRM, campaigns, attribution, receptionist workflows, and marketplace access in that firm-owned operating layer.

This standard does not require use of FlowLawyers or FlowCounsel. It defines the market structure those products are designed to support.

9. Governance and certification posture

This working draft is not a certification program. FlowLegal should not be the sole certifier of conformance to a standard it authored or implements commercially.

If a certification, audit, trustmark, procurement checklist, or agency-evaluation rubric develops around this standard, the governance process should include independent participation from law firms, legal-aid organizations, consumer-protection reviewers, privacy and security practitioners, marketing agencies, directory operators, intake vendors, CRM providers, and bar or ethics stakeholders.

Conformance review should examine production exports, endpoint maps, consent records, intake records, audit events, transition packets, and no-surveillance controls. A vendor should not be able to claim compliance merely because a contract says "the firm owns its data" while practical exports, endpoint transfer, attribution continuity, or consent evidence fail underneath.

10. References and related authorities

This standard is designed to operate alongside, not replace, existing legal, privacy, advertising, and professional-responsibility obligations. Relevant sources and authority areas include:

• ABA Model Rules of Professional Conduct, especially rules governing advertising, solicitation, confidentiality, competence, supervision, safekeeping property where applicable, and unauthorized practice where adopted by state law
• state bar attorney advertising, referral-service, solicitation, confidentiality, supervision, and fee-sharing rules
• Federal Trade Commission consumer-protection, endorsement, advertising, dark-pattern, data-security, and unfair-or-deceptive-practices authority
• state privacy, data-broker, consumer-protection, wiretap, recording, biometric, and sensitive-data laws where applicable
• ad-platform terms, analytics-platform terms, call-tracking terms, review-platform terms, and data-processing agreements
• the Consumer Legal AI Intake Standard, for AI-assisted intake, disclosure, consent, legal-aid posture, and model-training restrictions
• the Legal Lead Generation Standard, for compensated case-request distribution, distribution caps, source packets, and routing economics

The exact legal requirements vary by jurisdiction, platform, and firm engagement. This standard defines an operational baseline that should make vendor review, security review, and transition planning easier, not a substitute for legal advice.

11. Conformance annex: export packets and transition scenarios

This annex is non-binding implementation guidance. It makes the "firm owns its growth infrastructure" claim reviewable.

11.1 Vendor-transition packet template

A vendor-transition packet should include:

1. Scope statement: services covered, date range, accounts, profiles, campaigns, intake channels, phone numbers, domains, forms, chat flows, and tracking endpoints.
2. Ownership map: firm-owned, vendor-owned, platform-owned, transferable, non-transferable, and unknown assets.
3. Intake export: structured prospective-client records with source, campaign, disclosure, consent, routing, follow-up, status, and outcome fields where known.
4. Attribution export: campaign, source, landing page, phone line, UTM, referral, first-response, and retained-outcome fields where available.
5. Profile export: factual profile fields, attorney bios, practice areas, jurisdictions, service locations, languages, accessibility information, pro bono indicators, and source metadata.
6. Consent and privacy export: disclosure versions, consent states, revocation, suppression, deletion, retention, safe-contact preferences, and contact restrictions.
7. Endpoint migration plan: phone forwarding, form handoff, chat handoff, domain/DNS changes, tracking endpoint migration, and landing-page continuity.
8. Known exclusions: fields or assets excluded because of legal, platform, privacy, contractual, or technical constraints.
9. Open operational items: unhandled inquiries, pending follow-up, scheduled callbacks, unresolved duplicates, conflicts, or suppression requests.

11.2 Minimum export format requirements

A compliant export must be:

• structured
• machine-readable
• documented
• date-ranged
• deduplicable
• privacy-state aware
• usable without continued vendor dashboard access

CSV is acceptable for simple systems. JSON, API export, database export, or signed archive formats may be appropriate for larger systems. Screenshots, PDFs, and aggregate reports do not satisfy the export requirement.

11.3 Firm-side intake record schema

At minimum, a firm-owned intake record should be able to preserve:

• intake_id
• contact_id
• source_surface
• source_url_or_phone
• campaign_id
• ad_account_id
• utm_source
• utm_campaign
• practice_area
• jurisdiction
• created_at
• first_response_at
• disclosure_version
• consent_state
• authorized_transfer_scope
• ai_involvement
• legal_aid_branch_posture
• safe_contact_preferences_present
• contact_restrictions_present
• routing_path
• assigned_user_or_queue
• pipeline_stage
• outcome_status
• outcome_timestamp
• retention_state
• privacy_request_state

11.4 Adversarial conformance scenarios

1. Agency-owned ad account. A firm leaves its agency and loses campaign history. Compliant behavior: account ownership or transfer limitation was disclosed upfront and campaign history is exported at termination.
2. Dashboard-only CRM. A vendor says the firm owns its data but provides only dashboard access and PDF reports. Compliant behavior: provide structured export of intake, attribution, consent, and pipeline records.
3. Lost consent proof. A firm cannot prove what disclosure was shown to a consumer. Compliant behavior: disclosure version and consent event remain attached to the intake record.
4. Phone-number hostage. A vendor controls a call-tracking number and refuses migration support. Compliant behavior: endpoint ownership and forwarding limits were disclosed, and reasonable forwarding or migration support is provided where available.
5. Surveillance intake. A form page sends consumer legal need to ad networks. Compliant behavior: remove surveillance tooling from intake and preserve aggregate analytics only where consumer-identifiable legal need is not exposed.
6. AI receptionist drift. An AI receptionist collects detailed facts before disclosure or implies attorney-client relationship creation. Compliant behavior: enforce disclosure before detailed intake and keep relationship/consent/routing authority outside model control.
7. Review provenance failure. A review campaign cannot distinguish real client/consultation feedback from marketing artifacts. Compliant behavior: preserve enough provenance to support review integrity without exposing confidential facts.
8. Suppression lost in transition. A consumer revoked contact consent before vendor transition. Compliant behavior: suppression and contact restrictions export with the intake record and survive migration.

11.5 Linked reference points

• ABA Model Rule 7.2. https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_7_2_communications_concerning_a_lawyers_services/
• ABA Model Rule 1.6. https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/
• ABA Formal Opinion 512. https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf
• Federal Trade Commission, 16 CFR Part 255. https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-255
• Federal Trade Commission, Operation AI Comply. https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes
• W3C Web Annotation Data Model, useful for source/span annotation patterns. https://www.w3.org/TR/annotation-model/

12. Open questions for review

1. Which export fields should be mandatory for small firms versus larger firms?
2. Should ad-account ownership be mandatory, or should transferability plus campaign export satisfy the baseline?
3. What should count as sufficient review portability when platform rules restrict review export?
4. What retention periods are appropriate for non-retained consumer inquiries?
5. How should vendors prove no-surveillance intake without exposing internal implementation details?
6. What feedback fields should firms return to directories and lead-generation systems to improve matching while preserving confidentiality?

13. Closing position

Law firm marketing should compound for the firm, not only for the vendor.

The minimum standard is simple: the firm owns its public identity, intake records, attribution history, consent evidence, CRM state, and vendor-transition path. Vendors can still compete on strategy, execution, creative, media buying, software, and service quality.

They should not compete by trapping the firm's growth infrastructure.