Legal and expert texts

A site’s legal texts are its privacy notice and consent; its expert texts tell of qualifications and results. They are written simply, but exactly.

Texts you answer for

Until now a mistake in a text cost you a reader. In this lesson it can cost a fine, or the trust of your profession. There are two kinds of text in which the words answer to the law: legal ones (a privacy notice, a consent, terms of sale) and expert ones (an account of qualifications and results). They are alike in that simplicity here is not a whim but a necessity: a person must understand what they agree to and what they believe. And alike in that simplicity can’t cost accuracy.

A caveat first. This lesson is not legal advice. We are writing in October 2026, laws change, and your situation is your own. Everything you write in the practice is a teaching draft. Before it is published, it must be shown to a lawyer who knows your profession and your country. The rules themselves are gathered in the part on quality and the law; here we learn to write so that the lawyer has something to check.

Because the course is read in many places, the lesson names the English-speaking world’s rules: the EU and UK data protection laws, the US state laws and the US Federal Trade Commission (FTC), and the UK advertising regulator. Russia’s rules appear for comparison, because the course began there.

Personal data and the controller

Personal data is any information that relates to a particular person or allows them to be identified: a name, a phone number, an email, an address. If your site collects any of these through a form, it processes personal data. The one who decides why and how is called a controller in the EU’s General Data Protection Regulation (GDPR) and its UK twin, the UK GDPR. In the US the closest idea is the “business” in the California Consumer Privacy Act (CCPA, as amended by the CPRA). The controller is you: a sole proprietor, a self-employed person or a company.

What the law expects of a controller where texts are concerned, in outline:

• Tell people what you do. GDPR Article 13 lists what a notice must contain when you collect data from the person: who you are and how to reach you, the purposes and the legal basis, who receives the data, whether it leaves the country, how long it is kept, the person’s rights (including withdrawing consent), and the right to complain to the supervisory authority. Article 12 requires this in a “concise, transparent, intelligible and easily accessible form, using clear and plain language”. Plain language is the law here, not a style choice.
• In the US there is no single federal privacy law for ordinary sites, but there are rules that reach you anyway. California’s Online Privacy Protection Act (CalOPPA) requires a commercial website that collects personal information from Californians to post a privacy policy (the US name for what this course calls a privacy notice), and the CCPA adds a “notice at collection” for businesses above certain thresholds. And the FTC treats a privacy policy as a promise: saying one thing and doing another is a deceptive practice under Section 5 of the FTC Act.
• Other duties live outside the text: keeping the data secure, honoring requests to see or delete it, reporting a breach. We don’t touch them here, but remember that the text describes what you really do.

The last point matters. A notice and a consent aren’t a spell but a description of your real practice. If the text says “data is kept for three years” and you never delete it, the text is false.

Consent: what to say and how

Under the GDPR, where you rely on consent it must be freely given, specific, informed and unambiguous, shown by a statement or a clear affirmative act (Article 4(11)). In terms of a form:

• Specific and informed: the person sees which data, for what and who the controller is. “I agree to everything” won’t do.
• A clear act: the person does something themselves. A box they checked. Not “by clicking you agree”, and not a box that is already checked. Recital 32 says plainly that pre-checked boxes, silence and inactivity aren’t consent. Such a box counts as a dark pattern as well: the form decides for the person.
• Separate: a request for consent must be clearly distinguishable from other matters (Article 7(2)), and a newsletter gets its own box.
• As easy to withdraw as to give (Article 7(3)).
• Not always needed. Consent is only one of six lawful bases (Article 6). Replying to someone’s inquiry can often rest on taking steps at their request or on legitimate interests, and then you need a clear notice, not a box. If you do ask for a box, the consent must be real.
• Marketing is a separate matter. In the US, CAN-SPAM lets you send commercial email until someone opts out, as long as you follow its rules. In the UK and EU, the PECR and the ePrivacy rules (with GDPR) generally want prior opt-in for marketing email to individuals. Consent to answer a request is not consent to a newsletter. A separate box, a separate text.

For comparison, Russia’s law on personal data (152-FZ) leans harder on consent: it is the usual basis, it must be specific and conscious, and since 1 September 2025 it is drawn up separately from other documents. The Russian law on advertising (38-FZ, Article 18) likewise requires prior consent for advertising by phone and email.

By meaning, the text of a consent should name: who is responsible, which data, what for, what is done with it, how long, and how to withdraw consent. For a form that is two or three lines (we wrote one in the lesson on microcopy) with a link to the full notice.

A notice in plain words

A privacy notice is usually written in a language that ordinary people don’t read. That is bad not only for people: if a person didn’t read and didn’t understand, the consent stays a formality. So good practice is built in two layers: a short statement in plain words on top, and the full exact text below for those who need it. The UK’s ICO and the European data protection regulators recommend exactly this “layered” approach.

The short layer answers six questions:

1. Who handles it. A name or a company name, the status.
2. Which data. What exactly the person types into the form.
3. What for. One purpose, stated directly.
4. What is done with it and who gets it. Storage, the hosting company, an email service, if there are any.
5. How long it is kept. A period you can keep to.
6. How to withdraw consent and where to complain if rights were breached.

Now, what may be simplified and what may not. Words may be simplified: “collects, records and stores” becomes “we write it down and keep it”. Content may not: the six points above must stay. In the diagram below is a teaching notice for an invented site, point by point, in two forms. Try removing a required point and see what is missing.

An expert text: checkable and modest

Expert sites most often sin in two ways. Some boast: “the best”, “a recognized expert”, “we guarantee results”. Others hide: “an experienced specialist” without a single detail. One thing helps: checkability. Instead of a judgment, a document with a number. Instead of “many years of experience”, the year work began and the kind of cases. Instead of “we guarantee”, the order of action and what the result depends on.

Modesty here is not humility but honesty about limits. The phrase “I don’t take criminal cases or family disputes” doesn’t put people off, it reassures them: they see you know your limits. So does “Timing and price depend on the documents, so I give them after I have studied the papers”: you don’t promise what you can’t deliver.

What advertising law says

The description of your services on your site is most likely advertising in the legal sense, and the line between advertising and information can be thin, so it’s safer to behave as if it were advertising. The rules are alike in spirit across the English-speaking world:

• United States. The FTC Act bans unfair or deceptive acts. The FTC expects an advertiser to have a “reasonable basis”, usually evidence, for an objective claim before making it. Obvious exaggeration that no one takes literally (“the best coffee on Earth”) is called puffery and isn’t treated as a factual claim, but “the best surveyor in the county” sounds like a fact someone could test. The Endorsement Guides (16 CFR Part 255) say that a testimonial must reflect honest opinions and a material connection (payment, a free service) must be disclosed. Since 21 October 2024 the FTC’s rule on consumer reviews and testimonials (16 CFR Part 465) bans fake or bought reviews, which carries civil penalties per violation.
• United Kingdom. The CAP Code, applied by the Advertising Standards Authority (ASA), requires marketing not to mislead (section 3) and requires marketers to hold documentary evidence for objective claims before they make them (rule 3.7). A claim of “best” or “leading” must be backed by evidence or be obvious puffery. The consumer-protection law was reworked by the Digital Markets, Competition and Consumers Act 2024, which also deals with fake reviews.
• European Union. The Unfair Commercial Practices Directive (2005/29/EC) bans misleading actions and misleading omissions (Articles 6 and 7), and its blacklist, as updated in 2019, includes fake reviews.
• Conditions. “The first consultation is free” needs the terms: how long it lasts and what it includes. Leaving out material terms also misleads, and in the US the FTC has a guide on the word “free” (16 CFR Part 251).

For comparison, Russia’s advertising law (38-FZ, Article 5) requires advertising to be fair and reliable, and the Russian regulator, the FAS, accepts a superlative if the criterion of comparison is stated and can be proved. The idea is the same: a comparison needs a criterion and proof.

What the rules of the profession say

Many professions have their own restrictions, stricter than the general law. In the US, attorneys are bound by state bar rules, most modeled on the ABA Model Rules: Rule 7.1 bars false or misleading statements about the lawyer’s services, and Rule 1.6 protects client confidences. Many states want a disclaimer if you mention results. Land surveyors are licensed by state boards, which set their own rules on how a licensee may describe themselves. In England and Wales the Solicitors Regulation Authority sets similar duties, and an expert witness’s duty is to the court, which overrides any obligation to whoever instructs or pays them (Civil Procedure Rules, Part 35). Promising “the result you need” doesn’t fit that role. Which rules bind you is for your bar, your board, your regulator or a lawyer to say. For learning, remember the general frame:

• Don’t promise an outcome. “We’ll tell you what your chances are” instead of “we’ll win”.
• Don’t boast of win statistics. A court decides, not you, statistics can’t be checked, and clients’ cases are protected.
• Don’t name clients. A case study only anonymized and with the client’s written permission, and where the profession forbids it, no case studies at all: show how the work goes.
• Don’t compare yourself with colleagues. Tell about yourself.

Practice on the second tab of the diagram: statements about an expert that are allowed, need a source or aren’t allowed.

Where it lets you down

• Simplicity against accuracy. If you simplified the words and lost the retention period or the way to withdraw consent, the text got worse, not simpler. Check it against the list of six points.
• Someone else’s text. A notice copied from another site describes someone else’s processing. The controller is not you, the data and the periods differ, and the gap with your real practice makes the text false. Copy the structure, write the content yourself.
• Generated texts. Policy generators and model answers can be convincing and wrong: they mix up articles, go out of date, invent rules. This is a draft, not a source of law.
• The law changes. The rules on consent, reviews and dark patterns have moved in the last few years. The texts of this lesson will go out of date faster than your site. Check the current text at the time you publish.
• A legal text need not be ugly. If the full text must be complex, keep a short statement above it. People don’t read formulas, but they do read explanations.

Practice

Write a teaching draft of three things for your project. Remember: before real publication a lawyer will check it (the note at the bottom says so).

1. A page about personal data (the block privacy). Six points: who is responsible (your name from the brief), status, which data, what for, how long it is kept, and how to withdraw consent (the email address from the brief).
2. A consent beside the form. A separate checkbox box, not checked in advance, with text that says what is done with the data and a link to the privacy block.
3. Proofs. For each proof from the brief, write where it can be checked: the name of a register, a document number, a link. This is what turns “I have a license” into “here is the license, check it”.
4. A paragraph “About the work” (pitch): how you are useful, with no guarantees or superlatives. For an expert the check will look for words like “guarantee” and “best”.

If your brief has no proofs (for example in the “My project” template), the list of proofs will stay empty. Add some to the brief in settings: sites without proofs persuade less.