Why Lawyers Shouldn't Use Online PDF Tools (And the Exception)
Most lawyers wouldn't hand a client's file to a stranger on the street. But many regularly upload those same files to cloud PDF tools without a second thought.
That's a problem. Here's why — and what the exception looks like.
## Attorney-Client Privilege and Third-Party Disclosure
Attorney-client privilege protects confidential communications between a lawyer and their client. But it's not unconditional. Disclosure of privileged communications to third parties can waive the privilege.
The legal question — still evolving in most jurisdictions — is whether uploading a client document to a cloud service constitutes "disclosure" sufficient to waive privilege.
Courts haven't settled this uniformly. But the trend in ethics opinions is consistent: lawyers have a duty of competence that includes understanding the technology they use. The ABA's Model Rule 1.6 requires "reasonable measures to prevent the inadvertent or unauthorized disclosure" of client information.
"Reasonable measures" increasingly means knowing where your files go.
## What Bar Associations Are Saying
Ethics opinions from state bars have become increasingly specific about cloud services.
The New York State Bar Association has issued guidance requiring lawyers to understand the security practices of cloud vendors before using them. The California State Bar has issued similar guidance. The ABA's Formal Opinion 477R (2017) concluded that lawyers must evaluate the sensitivity of information against the risk of unauthorized disclosure when choosing communication methods.
None of these opinions ban cloud tools outright. But they require due diligence. You need to know: where does my file go, who can access it, what are the retention policies, is there a data processing agreement?
Most lawyers using Smallpdf or ILovePDF for quick merges have never asked those questions.
## The Business Associate Agreement Problem
For lawyers who handle healthcare matters — medical malpractice, disability claims, healthcare regulatory work — there's an additional layer: HIPAA.
Patient health information in legal files is still PHI. If you're uploading files containing PHI to a cloud PDF tool, that vendor needs to be a HIPAA Business Associate with a signed BAA.
ILovePDF doesn't offer BAAs. Smallpdf doesn't offer BAAs. Most of the convenient free tools don't, because they're not positioning themselves as healthcare-compliant services.
Uploading a medical record to one of these tools could create HIPAA exposure for your client and your firm.
## The Metadata Problem
PDFs carry metadata: author names, creation dates, modification dates, sometimes revision history. If you're editing a document and the metadata shows it was modified after a date you're claiming it was finalized — that's discoverable.
Most lawyers know to strip metadata before producing documents in litigation. Fewer think about what happens when metadata travels to a cloud server, gets logged, and potentially ends up in a vendor's records.
## The Exception: Client-Side Tools
Here's where the calculus changes completely.
Client-side PDF tools — tools that run entirely in your browser without uploading files to any server — eliminate the third-party disclosure problem. There's no third party. Your files never leave your device.
No third party means no privilege waiver risk. No third party means no BAA requirement for PHI. No data transfer means no GDPR or state privacy law compliance concerns.
We built WhisperDocs as a client-side tool specifically because the upload model creates unnecessary risk. Merge, split, compress, encrypt, redact — all of it runs in your browser. Turn off WiFi and it still works. That's how you know.
Open DevTools while you use it. Watch the Network tab. You'll see the file operations happen without a single upload. That's not a policy statement — it's a verifiable technical fact.
## Due Diligence That Takes 30 Seconds
Before using any PDF tool with client files, run the WiFi test: disconnect from the internet and try to use the tool. If it fails, your files were going to a server. If it works, your files stayed local.
That's the level of competence your clients deserve. And increasingly, it's the level bar associations are starting to expect.
[Try WhisperDocs](/merge-pdf) — no upload, no server, no third-party disclosure. Verify it in DevTools before you use it with client files.
That's a problem. Here's why — and what the exception looks like.
## Attorney-Client Privilege and Third-Party Disclosure
Attorney-client privilege protects confidential communications between a lawyer and their client. But it's not unconditional. Disclosure of privileged communications to third parties can waive the privilege.
The legal question — still evolving in most jurisdictions — is whether uploading a client document to a cloud service constitutes "disclosure" sufficient to waive privilege.
Courts haven't settled this uniformly. But the trend in ethics opinions is consistent: lawyers have a duty of competence that includes understanding the technology they use. The ABA's Model Rule 1.6 requires "reasonable measures to prevent the inadvertent or unauthorized disclosure" of client information.
"Reasonable measures" increasingly means knowing where your files go.
## What Bar Associations Are Saying
Ethics opinions from state bars have become increasingly specific about cloud services.
The New York State Bar Association has issued guidance requiring lawyers to understand the security practices of cloud vendors before using them. The California State Bar has issued similar guidance. The ABA's Formal Opinion 477R (2017) concluded that lawyers must evaluate the sensitivity of information against the risk of unauthorized disclosure when choosing communication methods.
None of these opinions ban cloud tools outright. But they require due diligence. You need to know: where does my file go, who can access it, what are the retention policies, is there a data processing agreement?
Most lawyers using Smallpdf or ILovePDF for quick merges have never asked those questions.
## The Business Associate Agreement Problem
For lawyers who handle healthcare matters — medical malpractice, disability claims, healthcare regulatory work — there's an additional layer: HIPAA.
Patient health information in legal files is still PHI. If you're uploading files containing PHI to a cloud PDF tool, that vendor needs to be a HIPAA Business Associate with a signed BAA.
ILovePDF doesn't offer BAAs. Smallpdf doesn't offer BAAs. Most of the convenient free tools don't, because they're not positioning themselves as healthcare-compliant services.
Uploading a medical record to one of these tools could create HIPAA exposure for your client and your firm.
## The Metadata Problem
PDFs carry metadata: author names, creation dates, modification dates, sometimes revision history. If you're editing a document and the metadata shows it was modified after a date you're claiming it was finalized — that's discoverable.
Most lawyers know to strip metadata before producing documents in litigation. Fewer think about what happens when metadata travels to a cloud server, gets logged, and potentially ends up in a vendor's records.
## The Exception: Client-Side Tools
Here's where the calculus changes completely.
Client-side PDF tools — tools that run entirely in your browser without uploading files to any server — eliminate the third-party disclosure problem. There's no third party. Your files never leave your device.
No third party means no privilege waiver risk. No third party means no BAA requirement for PHI. No data transfer means no GDPR or state privacy law compliance concerns.
We built WhisperDocs as a client-side tool specifically because the upload model creates unnecessary risk. Merge, split, compress, encrypt, redact — all of it runs in your browser. Turn off WiFi and it still works. That's how you know.
Open DevTools while you use it. Watch the Network tab. You'll see the file operations happen without a single upload. That's not a policy statement — it's a verifiable technical fact.
## Due Diligence That Takes 30 Seconds
Before using any PDF tool with client files, run the WiFi test: disconnect from the internet and try to use the tool. If it fails, your files were going to a server. If it works, your files stayed local.
That's the level of competence your clients deserve. And increasingly, it's the level bar associations are starting to expect.
[Try WhisperDocs](/merge-pdf) — no upload, no server, no third-party disclosure. Verify it in DevTools before you use it with client files.