Brandon Burke Picture a paralegal emailing a draft settlement agreement to opposing counsel as a Word file. The visible text looks clean. The tracked changes still hold an earlier draft, though. A margin comment from the supervising attorney notes the lowest number the client will accept. Anyone who opens the review pane can read it. That is the core risk of metadata in legal documents.
Here is the short answer. Before a file leaves the privilege, remove metadata that could reveal client confidences. That duty comes from Rule 1.6(c). When you receive metadata in legal documents from the other side, your obligations depend on your state. ABA Formal Opinion 06-442 finds no specific bar on reviewing it. Florida and New York restrict it. Documents produced in discovery follow their own rules, and stripping metadata from them can be improper.
This is general information, not legal advice. Your state’s rules and ethics opinions control.
What metadata in legal documents actually reveals
Metadata is data about a file that travels with the file. Most of it is harmless. Minnesota Opinion 22 says it plainly: “Most metadata is not confidential.” The risk sits in the part that is.
| Type of metadata | Example | What it can expose |
|---|---|---|
| Template from another matter | A pleading built from an old file still carries the prior client’s name in a field or property | Another client’s identity or facts |
| Tracked changes | Deleted text in a settlement draft still shows an earlier figure | Your negotiating position |
| Comments | An attorney’s margin note on the weak points of a claim | Strategy and work product |
| Author and edit history | Names of everyone who edited the file, with dates | Who is working the matter, and when |
| File properties | Title, company, and original file name fields | Internal labels and earlier uses of the file |
| Photo data | A phone photo can carry the date it was taken and, depending on settings, location | When and where a client was |
The Minnesota opinion gives similar examples. It names templates that carry names from another matter, internal comments on a case’s strengths and weaknesses, and settlement documents that reveal what a side will pay or accept.
Almost none of this shows in a normal view of the document. Staff need to know where to look. Our guide to redacting information in a PDF walks through the practical sanitizing steps.
Before you send: reasonable care is the standard
Rule 1.6(c) requires reasonable efforts to prevent unauthorized disclosure of client information. Comment 18 to Rule 1.6 lists the factors, and comment 19 adds more for transmitting communications. They include the sensitivity of the information and the likelihood of disclosure without safeguards. They also include the cost and difficulty of safeguards, and whether they would hurt the representation.
Apply those factors to the file in front of you. A settlement draft going to opposing counsel scores high on sensitivity. A final brief that is already filed with the court scores low.
Comment 8 to Rule 1.1 asks lawyers to keep up with the benefits and risks of relevant technology. Knowing that a Word file carries its edit history is part of that competence.
State bars have said the same thing directly. Florida Bar Ethics Opinion 06-2 says a sending lawyer should “take care to ensure the confidentiality of all information contained in the document, including metadata.” NYSBA Ethics Opinion 782 says lawyers “must exercise reasonable care” to prevent disclosure of confidences in metadata sent to opposing counsel or other third parties.
NYSBA Opinion 782 also names the situations that raise the risk:
- The document started from a template used for another client.
- It went through multiple drafts with comments from several people.
- The client added comments.
- The recipient is opposing counsel or another third party.
The New York opinion was decided under the state’s former Code, but its list still works as a quick screen. Arizona’s EO-20-0008 takes a similar line on the sending side. It expects lawyers to scrub confidential metadata before a file goes to anyone outside the client and others within the privilege.
Paralegals and case managers send most of a firm’s files. Rule 5.1 and Rule 5.3 require partners and supervising lawyers to make reasonable efforts to ensure that lawyers follow the rules and that staff conduct fits the lawyers’ obligations. In practice, that means a written metadata policy and training for the people who actually hit send. Fold it into your broader information security best practices. For the underlying duty, see our guide to lawyer client confidentiality.
When you receive it: the rules split by state
The receiving side starts with Rule 4.4(b). A lawyer who receives a document or electronically stored information and “knows or reasonably should know” it was sent by mistake “shall promptly notify the sender.” The comments explain how that applies to metadata.
Metadata in electronic documents creates an obligation under this Rule only if the receiving lawyer knows or reasonably should know that the metadata was inadvertently sent to the receiving lawyer.
The Rule 4.4 comments also say that whether you must do more, such as return the document, is a question of law beyond the rules.
ABA Formal Opinion 06-442 adds that the ABA Model Rules contain no specific prohibition on reviewing and using metadata from opposing counsel. Its answer for a worried sender is to scrub the file or send a different version. Several states disagree.
| Jurisdiction | Reviewing received metadata | Other key points |
|---|---|---|
| ABA (Formal Opinion 06-442) | No specific prohibition in the Model Rules | Rule 4.4(b) notice still applies if you know or should know it was sent by mistake |
| Florida (Opinion 06-2) | Restricted. Don’t try to obtain confidential information from metadata you know or should know wasn’t meant for you | If you obtain it inadvertently, promptly notify the sender. The opinion doesn’t address discovery |
| New York (NYSBA Opinion 782) | Restricted. The opinion points back to an earlier New York opinion that treated using computer technology to access client confidences in a received document’s metadata as impermissible | Senders must use reasonable care to protect metadata |
| Arizona (EO-20-0008) | You may view metadata that is readily visible in the native software, unless you know or should know it was included by mistake | Material confidential or privileged metadata should be assumed inadvertent. “Mining” with special software violates Arizona’s ER 4.4(a) |
| Minnesota (Opinion 22) | The opinion doesn’t impose a duty to look or not to look | Removing metadata from evidentiary documents in litigation may be impermissible or illegal |
Other states have issued their own opinions, and they don’t all agree. Check your state’s rule and ethics opinions before anyone on your team digs into a received file. If the matter crosses state lines, confirm which jurisdiction’s rules govern.
Discovery is a different set of rules
Everything above is about ordinary correspondence: drafts, letters, and negotiation documents. Discovery works differently. Florida Opinion 06-2 says outright that it isn’t meant to address metadata in discovery documents.
In a production, the metadata can be the evidence. Edit dates, authors, and file history may matter to the case. FRCP 34(b)(2)(E)(ii) covers requests that don’t specify a form for electronically stored information. In that case, you produce it “in a form or forms in which it is ordinarily maintained or in a reasonably usable form or forms.” Any ESI agreement or court order controls too.
So don’t strip metadata from documents you are producing unless your ESI agreement or a court order allows it. Minnesota Opinion 22 warns that removing metadata from evidentiary documents “may be impermissible or illegal.” Arizona’s EO-20-0008 likewise says its scrubbing guidance doesn’t limit your duty to produce native files with intact metadata when discovery rules require it.
Privileged material that slips into a production has its own process. FRCP 26(b)(5)(B) lets the producing party notify you of a privilege claim. After that notice, you must promptly return, sequester, or destroy the information and not use it until the claim is resolved. Federal Rule of Evidence 502 addresses when an inadvertent disclosure waives privilege and lets courts enter orders against waiver. State courts have their own versions, so check the rules for your forum.
A pre-send checklist for your team
Use this before any file goes to opposing counsel, an adjuster, or another third party.
- Confirm who the recipient is. Files going to the client are lower risk. Files leaving the privilege get the full review.
- Check whether this is a discovery production. If it is, stop here. Follow FRCP 34, your ESI agreement, and any court order instead of scrubbing.
- Start from a clean document. Don’t reuse a template or prior file from another client’s matter.
- Resolve every tracked change and delete every comment. Switching to a view that hides markup isn’t enough. The changes stay in the file until you accept or reject them.
- Run your software’s document inspection feature. Review the author, company, and title fields it finds.
- Send a PDF when the recipient doesn’t need to edit. Conversion can drop some metadata, but not always all of it. Still sanitize the PDF using the steps in our PDF redaction guide.
- Send a deliberate redline when one is expected. In negotiations, generate a fresh comparison for the other side rather than sending your working draft.
- Check client-supplied files too. Photos, scans, and records from clients carry their own metadata.
- Open the final file as the recipient would. Check the review pane, properties, and any hidden content before sending.
A confidentiality notice in your email footer doesn’t replace this review. An email confidentiality clause is useful, but the attachment still needs to be clean. For more on safe channels, see our guide to secure file sharing with clients.
What to do when you find something you shouldn’t have
Say a case manager opens a document from opposing counsel and finds comments about their client’s settlement limits. Here is a sequence to follow.
- Pause and don’t circulate it. Don’t forward the file around the office until an attorney decides how to handle it.
- Bring it to the supervising attorney. This is a judgment call for a lawyer, and your Rule 5.3 policy should say so.
- Check the governing rule. Confirm your state’s version of Rule 4.4(b) and any ethics opinion on metadata.
- Decide whether it was sent by mistake. Under Arizona’s EO-20-0008, metadata that appears to be material confidential information, or that reveals privileged communications or work product, should be assumed inadvertent.
- Notify the sender promptly if the rule requires it. Under Rule 4.4(b), notice is the baseline duty.
- Don’t use special software to dig further. Arizona treats “mining” as a violation, and Florida and New York restrict review.
- Follow the clawback rules in discovery. If it came in a production, FRCP 26(b)(5)(B) and any protective order govern what happens next.
- Write down what happened. Record what was found, who saw it, and what notice went out, with dates.
Where CasePulse fits
Many of the files a firm sends out started with the client. We built CasePulse as a client portal layer on top of the case management system your firm already uses. We work with Neos, Needles, LawBase, Litify, and Salesforce.
Clients securely upload documents from any device. Uploaded files save to your CMS when supported, or your team reviews and downloads them. Clients also get secure access to their messages and files. Those uploads arrive with their own metadata, such as the capture date on a phone photo of an injury or the properties of a scanned record. Some of those files later go to an adjuster or opposing counsel. We don’t scrub or inspect metadata, so that review stays with your firm before a file leaves. Run client-supplied files through the same pre-send checklist as your own drafts.
See everything the portal does on our features page.