Retargeting rules
Can a law firm retarget website visitors, and what are the rules?
What Google and Meta allow law firms to do with website visitor audiences, practice by practice, plus the privacy and bar rules that sit alongside them.
By Santiago Alvarez, Founder, Ad Hoc Digital
Last updated
The short answer
If you read one part of this page, read this.
Often yes on Meta, and it depends on the practice on Google. On Meta, a firm can show ads to past website visitors as long as the pixel never sends health, financial or other sensitive details and the audience isn't built on them. On Google, the personalized advertising policy names criminal defense lawyers, divorce services, bankruptcy services and services for immigrants as sensitive categories, and advertisers in those can't use their own audience lists at all.
We found no Meta or Google page that lists "legal services" as a restricted category by that name. The limits come from what a practice touches: crime, relationships, money, health and immigration status. Privacy law adds its own layer, from California's opt-out of "sharing" to the UK's consent rule for advertising cookies.
We set up tracking so retargeting is possible where it's allowed and nothing sensitive leaves the site where it isn't. We work with law firms across the US and Canada, and also in Australia and the UK.
How it works
Retargeting shows your ads again to people who already visited, watched or filled in a form.
Code on your site, or a list you upload, tells the platform who has interacted with the firm. You then aim ads at that group, or exclude it.
- On Meta
Meta calls these custom audiences. A website custom audience is built from visits the Meta Pixel records. Others come from people who watched your videos, opened or submitted your lead form, or interacted with your Instagram account. A customer list audience matches emails or phone numbers you upload, which are hashed before Meta receives them.
- On Google
Google now calls remarketing "your data". Your data segments can show ads to past visitors across Display sites and apps, on YouTube, and in Search when they search again. Customer Match does the same from a list of contact details.
- What it's for in a law firm
Retargeting is a second touch, not the campaign. The first touch still has to be a sharp ad to new people, like the dedicated rideshare campaign that produced a case that settled for $1.5 million. Retargeting reminds the people who looked and didn't call, and keeps signed clients from seeing ads meant for strangers.
On Google, criminal defense, divorce, bankruptcy and immigration services can't use your own audience lists.
Google's personalized advertising policy lists sensitive interest categories. Advertisers promoting services in them can't use advertiser-curated audiences, which include your data segments and Customer Match.
| Practice | Google's category | What Google's page names | Your own audience lists |
|---|---|---|---|
| Criminal defense and DUI | Commission of a crime | "Criminal defense lawyers", "Bail bonds services" | Not allowed |
| Family law (divorce) | Relationship hardships | "Divorce services" | Not allowed |
| Bankruptcy and debt | Negative financial status | "Bankruptcy services", "Debt-focused products and support" | Not allowed |
| Immigration | Marginalized groups | "Services for immigrants", "Legal services for refugees" | Not allowed |
| Victims' rights, protective orders | Abuse and trauma | "Victim advocate services" | Not allowed |
| Injury, estate planning, business law | None named | No legal service named | Allowed, unless the ads or pages fall in a category such as Health |
What's blocked is the advertiser's own data: your data segments, Customer Match, audience expansion and lookalike segments. Google's predefined audiences, such as in-market, affinity and life events, stay available because Google strips sensitive signals out of them. Google also notes that Demand Gen campaigns use advertiser-curated audiences by default and may be restricted for these categories.
For Google Ads in criminal defense, family, bankruptcy or immigration, our advice is to leave audience lists out from the start and run on keywords. A list that Google later flags only adds a disapproval to fix. Our criminal defense marketing and family law marketing pages cover what those accounts run on instead.
Meta
Meta has no legal services category. Its limits are on the data you send it.
On Meta, the question isn't whether your practice may retarget. It's whether your pixel, events, URLs and audiences carry information Meta's terms prohibit.
- Prohibited information
Meta's Business Tools terms bar sharing health information, financial information and other sensitive categories. Meta's examples include diseases, medical conditions and injuries, and debt status. That covers what the pixel sends: event names, custom data, page URLs and UTM parameters, not only form fields.
- Pages where people type sensitive details
Meta says not to send information from pages where visitors log in and provide sensitive information, and gives patient portals as the example. For a law firm, our reading is that the intake questionnaire and the client portal are the equivalent. The pixel stays off them.
- Audience names and rules
The names and criteria for your events, conversions and custom audiences must not reflect or imply prohibited information. Meta flags audiences that reference a health condition or financial status, and flagged audiences can't be used in new campaigns. "Website visitors, 30 days" is safe. A name built around someone's debt or injury isn't.
- Meta may restrict your site itself
Meta can assign your website a data source category and limit what it accepts, from stripping URL details to blocking events entirely. The category shows in Events Manager, and you can ask Meta to review it.
- What the retargeting ad says
Meta's personal attributes policy bars ads that imply the advertiser knows something about the viewer. "Still thinking about your DUI case?" to a past visitor does exactly that. A general ad for the firm, shown again, does not.
Bar rules
Bar rules don't name retargeting, but ads aimed at a specific legal problem get scrutiny.
No bar rule we read mentions retargeting by name. Florida's handbook is the clearest on targeted social ads, and it's a useful warning for firms anywhere.
The Florida Bar's handbook says some paid social ads must follow the rules for direct electronic solicitation because they're aimed at people who meet criteria showing a specific legal problem. Targeted social media about personal injury, wrongful death or an accident can't be sent until 30 days after the event, and targeted social media ads are filed at least 20 days before use. The Board of Governors applied this to a paid post aimed at people who had self-identified a legal issue.
Our reading, not the Bar's: showing a general firm ad to everyone who visited the site is closer to ordinary advertising than aiming accident ads at people because of what they revealed. A Florida injury firm that wants to retarget visitors of one accident page should ask the Bar first. Our guides to social media rules for lawyers and the Florida Bar's advertising rules go further.
Privacy law
Privacy law adds consent and opt-out duties that depend on where your visitors are.
Platform rules decide what the pixel may send. Privacy law decides whether you may track the visitor at all, and what you must tell them.
- California (CCPA)
The California Department of Justice's CCPA page says the CCPA applies to for-profit businesses doing business in California that have gross annual revenue over $25 million, buy, sell or share the personal information of 100,000 or more California residents or households, or earn half or more of their revenue from selling it. "Sharing" means cross-context behavioral advertising, which is what retargeting is. Covered businesses must honor opt-outs, including the Global Privacy Control signal. Other states have their own laws; check yours.
- Canada (PIPEDA)
The Office of the Privacy Commissioner's guidelines say tracking for behavioural advertising will generally involve personal information. Opt-out consent can be reasonable if people are told the purpose clearly at or before collection, can opt out easily and permanently, and the information stays away from sensitive categories such as health and financial data.
- United Kingdom (PECR)
The ICO says you must tell people about cookies and get consent, given by a clear positive action, before setting any that aren't strictly necessary. Advertising and tracking cookies aren't strictly necessary, and the ICO asks for particular care with behavioural tracking and sensitive data. Our UK solicitor marketing guide covers the rest.
This is a plain summary for marketing planning, not legal advice. Check the current rule with your bar or law society.
Our setup
How we set up tracking so retargeting stays inside the lines.
Most of the risk sits in tracking that was installed once and never looked at again. These are the checks we run when we set up or take over an account.
Decide where the pixel runs
Practice pages, the home page and the booking confirmation, yes. Intake questionnaires, client portals and document upload pages, no.
Make URLs and event names generic
"/thank-you" and a standard Lead event, never a page address or event name that spells out a charge, an injury or a debt. UTM tags carry the campaign and ad name, nothing about the person.
Send conversions from the CRM with contact fields only
When we wire the Conversions API, the event carries what Meta uses to match a person (name, email, browser and click identifiers) and nothing about the matter. Our lead forms vs website guide explains that setup.
Name audiences neutrally
By source and time window, such as "Video viewers, 60 days", never by the person's situation.
Check the practice before adding Google lists
Criminal, family, bankruptcy, immigration and victims' work run without them. Other practices can use them, and the privacy policy has to explain the ad tracking.
Add consent where the law needs it
A cookie consent tool for UK sites, and an opt-out route where a US state law applies to the firm. Whoever manages the website should be able to show you both.
Look at Events Manager monthly
Meta reports blocked parameters, prohibited information warnings and the data source category there. A warning means something on the site changed.
A worked example
A hypothetical firm doing injury and criminal defense.
This is an illustration, not a result. The firm is invented to show how one firm can face two different answers.
Same firm, same website, and the answer changes by platform and by practice. More on the injury side on our personal injury marketing page, and on the ad side on our Meta ads page.
Common mistakes
Where firms go wrong.
We find these when we audit tracking on accounts firms bring to us.
Remarketing lists on criminal, divorce or bankruptcy campaigns
Google names those services as sensitive. Audience lists there lead to disapprovals, so leave them out.
The pixel on the intake questionnaire
The page where someone describes what happened is the last place a tracking script should run.
Case details in URLs and event names
"/injury-claim-submitted?type=spinal" sends Meta health information through the address bar. Keep addresses generic.
Retargeting copy that shows you were watching
"Still thinking about your case?" implies knowledge of the viewer's situation. Show the general firm ad again instead.
No consent tool on a UK site
Advertising cookies need consent before they're set. A banner that sets them anyway doesn't count.
Real results
What this looked like for real firms.
Our Meta ads result: a dedicated rideshare campaign for a personal injury client, which brought in a case that settled for $1.5 million.
Identifying details are anonymized to protect our clients. Individual result, not a promise or prediction of any specific outcome for your firm.
FAQ
Questions lawyers ask us.
Straight answers to the questions that come up most.
Is retargeting allowed for law firms?
Generally yes, with limits. Meta allows website custom audiences as long as no sensitive information is sent or used. Google bars its own-audience tools for services it lists as sensitive, including criminal defense lawyers, divorce, bankruptcy and services for immigrants. Privacy and bar rules then add their own limits, depending on where you and your visitors are.
Can a criminal defense lawyer use Google remarketing?
No. Google's Commission of a crime category names "Criminal defense lawyers" as an example, and advertisers in sensitive categories can't use advertiser-curated audiences such as your data segments or Customer Match. Predefined Google audiences are still allowed. Criminal defense campaigns on Google run on keywords.
Can a family law firm retarget on Facebook?
Yes, Meta doesn't bar it. Keep the pixel and audience names free of anything about the person's situation, and make the retargeting ad a general firm message rather than one that implies you know they're divorcing. On Google, divorce services fall under Relationship hardships, so own-audience lists are off there.
Can a law firm use the Meta Pixel on its website?
Yes. Meta's rules are about what it sends: no health, financial or other sensitive information in events, URLs, UTM tags or audience names, and nothing from pages where people type sensitive details. Keep it off intake questionnaires and client portals, and check Events Manager for warnings.
Do we need a cookie banner for retargeting?
In the UK, yes: the ICO says non-essential cookies need consent before they're set. In Canada, the privacy commissioner accepts opt-out consent for behavioural ads under conditions. In the US it depends on state law and whether it applies to your firm, so check with your own privacy counsel.
Can we upload our client list to Facebook or Google?
Meta's terms require a lawful basis, no audience criteria based on health or financial information, and removing anyone who opts out. Google bars Customer Match for sensitive categories like criminal defense and bankruptcy. Uploading clients also raises confidentiality questions that belong with your bar, and using it only to exclude past clients from ads is the narrower choice.
Does retargeting count as solicitation?
No rule we read names it. Florida treats some paid social ads aimed at people with a specific legal problem as targeted solicitation, with a 30-day wait for injury and accident matters. General firm ads shown to past visitors are a different thing. If you're unsure, ask your bar, or schedule a consultation and we'll walk through your setup.
Where we do this
The services this guide touches.
What this looks like when we run it for a firm, with a demo for your practice on each page.
Sources
Where these facts come from.
Official pages we read when writing this page. Platforms and rules change, so check the current version before you act on any of it. This is marketing guidance, not legal advice.
- Google Advertising Policies Help, Restricted targeting in Personalized advertising
- Google Advertising Policies Help, Commission of a crime in personalized advertising
- Google Advertising Policies Help, Relationship hardships in personalized advertising
- Google Advertising Policies Help, Negative financial status in personalized advertising
- Google Advertising Policies Help, Marginalized groups in personalized advertising
- Google Advertising Policies Help, Abuse and trauma in personalized advertising
- Google Advertising Policies Help, Health in personalized advertising
- Google Ads Help, About your data segments
- Meta Business Help Center, About custom audiences
- Meta Business Help Center, About Prohibited Information
- Meta Business Help Center, Understand restrictions on certain custom audiences
- Meta Business Help Center, Understand data sharing restrictions based on source categories
- Meta, Customer List Custom Audiences Terms
- Meta, Meta Business Tools Terms
- Meta Transparency Center, Privacy Violations and Personal Attributes
- The Florida Bar, Handbook on Lawyer Advertising (13th edition, December 10, 2025)
- California Department of Justice, California Consumer Privacy Act (CCPA)
- Office of the Privacy Commissioner of Canada, Guidelines on privacy and online behavioural advertising
- Information Commissioner's Office, Cookies and similar technologies
Written by
Founder of Ad Hoc Digital. Leads strategy and works directly with every client firm on AI search, Local Services Ads, Google Ads and Meta ads.
More about SantiagoWant a second pair of eyes on this?
Book a free 30-minute call. Tell us how cases come in today, and we'll tell you straight what we'd change, and whether we can help.