“Probably required” is the answer you’ll hear most often when lawyers ask each other whether client data has to be anonymized before it goes into a model. Probably isn’t a rule. No Minnesota rule requires anonymization. And most of the lawyers who anonymize anyway do the easy half and quit.
The real answer is more useful than “probably”, because it tells you what a scrubbed prompt has to accomplish, when you need one, when you don’t, and when it can’t save you.
The word isn’t in the rule
Rule 1.6 of the Minnesota Rules of Professional Conduct runs three paragraphs, eleven enumerated exceptions, and nineteen comments. The word “anonymize” isn’t in it. Neither is “redact” or “de-identify”. None of the three shows up in ABA Formal Opinion 512, the ABA’s generative-AI opinion, or in the September 2024 Bench & Bar column on that opinion by Susan M. Humiston, then the Director of the Office of Lawyers Professional Responsibility. The Lawyers Professional Responsibility Board lists eleven active opinions. Not one of them touches generative AI.
What the rule has instead is two sentences in Comment [4], and they do all the work:
“This prohibition also applies to disclosures by a lawyer that do not in themselves reveal protected information but could reasonably lead to the discovery of such information by a third person. A lawyer’s use of a hypothetical to discuss issues relating to the representation is permissible so long as there is no reasonable likelihood that the listener will be able to ascertain the identity of the client or the situation involved.”
Those sentences were written for the hallway conversation and the bar listserv. Word for word, they’re also the test a scrubbed prompt has to pass. A prompt built from a matter is a hypothetical told to a very attentive listener with a very good memory.
The first sentence is why stripping names isn’t enough. A disclosure that doesn’t itself reveal protected information is still prohibited if it “could reasonably lead to the discovery” of that information. The second sentence names two things the listener must be unable to reach, and the second of the two, “the situation involved”, is where nearly every homemade anonymization falls apart.
What the rules actually require
Here’s the prohibition, Rule 1.6(a): “Except when permitted under paragraph (b), a lawyer shall not knowingly reveal information relating to the representation of a client.” Comment [3] sets the scope, and it’s broad on purpose: the rule covers “all information relating to the representation, whatever its source.” A fact you got off a public docket is still information relating to the representation.
Then there’s Rule 1.6(c), which applies whether or not anything got out on purpose: “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”
Between those two paragraphs sit four ways to put matter information in front of a model without violating 1.6(a). You can’t swap one for another, and picking among them is the real decision:
| Route | Where it lives | What it depends on | Where it runs out |
|---|---|---|---|
| Informed consent | Rule 1.6(b)(1); Rule 1.0(f) | The client’s agreement after adequate explanation of risks and alternatives | Boilerplate does not count; silence, in general, does not count |
| Minnesota’s non-privileged, non-harmful exception | Rule 1.6(b)(2); LPRB Opinion 26 | The information itself: not privileged, not held inviolate, not embarrassing or likely detrimental | Most case-strategy prompts contain privileged or harmful material |
| Implied authorization | Rule 1.6(b)(3); Comment [5] | Disclosure appropriate to carrying out the representation | Opinion 512 closes it for self-learning tools |
| A hypothetical that passes Comment [4] | Comment [4] | The prompt cannot lead anyone to the client or the situation | “The situation involved” |
All four sit under Rule 1.6(c) and its reasonableness factors, which Comment [17] lists: “the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer’s ability to represent clients”.
Now the self-learning problem, which is where most of the worry comes from. Opinion 512, issued July 29, 2024, reasons at page 6 that self-learning tools, “by their very nature, raise the risk that information relating to one client’s representation may be disclosed improperly,” and concludes at page 7 that “a client’s informed consent is required prior to inputting information relating to the representation into such a GAI tool.” Then it carves out the case where nothing from the matter goes in: “if a lawyer is using the tool for idea generation in a manner that does not require inputting information relating to the representation, client informed consent would not be necessary.”
The idea-generation carve-out and Comment [4] run on the same idea. A tool can’t leak what it never got. Opinion 512 doesn’t say a Comment [4]-grade hypothetical fits inside its carve-out. That’s my reading. The ABA hasn’t said it. But the logic is the same: if the listener can’t get from the input to the client or the situation, the input isn’t carrying the thing the rule protects.
Humiston’s column read Opinion 512 as “particularly instructive for Minnesota lawyers”, “[b]ecause Minnesota generally follows the model rules of relevance on this topic,” and put the consent point this way: “The opinion posits, and I tend to agree, that the use of many generative AI tools (beyond simple idea-generation tools) will generally require a client’s informed consent.” Notice that sentence drops 512’s self-learning qualifier. If that’s how Minnesota’s regulators are going to come at the question, the Comment [4] route matters more, not less.
Minnesota isn’t the Model Rules, and the Board said so about hypotheticals
“Generally” was doing a lot of work in that column, and less than five months later the Board showed where.
On January 20, 2025, the Lawyers Professional Responsibility Board adopted Opinion 26, on lawyers posting to listservs. The ABA had issued Formal Opinion 511R on the same subject, and the Board quoted its rule: no posts “in hypothetical or abstract form, without the client’s informed consent if there is a reasonable likelihood that the lawyer’s questions or comments will disclose information relating to the representation that would allow a reader then or later to infer the identity of the lawyer’s client or the situation involved.” The Board didn’t follow it. Its opinion says 511R “is not applicable to the Minnesota Rules of Professional Conduct”, because Minnesota has an exception the Model Rules don’t.
That exception is Rule 1.6(b)(2). A Minnesota lawyer may reveal information relating to the representation if “the information is not protected by the attorney-client privilege under applicable law, the client has not requested that the information be held inviolate, and the lawyer reasonably believes the disclosure would not be embarrassing or likely detrimental to the client”. Opinion 26 holds that information within that clause can go on a listserv without the client’s informed consent, and it doesn’t mince words about the difference: “Minnesota takes a measured, practical approach to client confidentiality as compared to the more restrictive ABA Model Rule.” Board opinions don’t bind the Supreme Court, but the Board’s Opinion 1 calls them “rule interpretations that guide attorneys’ professional conduct”.
So what about prompts? Opinion 512’s consent requirement is a reading of the Model Rules, and the Model Rules have no (b)(2). A prompt made up entirely of information that isn’t privileged, isn’t held inviolate, and isn’t reasonably believed to be embarrassing or detrimental is (b)(2) information whether it lands on a listserv or in a model. I read Opinion 26 to cover it. That’s my reading. The Board hasn’t said it.
Now, what (b)(2) does and does NOT get you. It’s a test of the information itself, and all three conditions have to hold. The first one sinks most litigation prompts: the facts you most want analyzed are usually the client’s own account of them, and that’s the heart of the privilege. The third is harder than it looks, because your belief about detriment has to account for where the information is going, and Opinion 512 describes a self-learning tool that “may disclose information relating to the representation to persons outside the firm who are using the same GAI tool.” Opposing counsel is a person outside the firm. A fact that’s harmless in a listserv post among colleagues can be likely detrimental when the listener includes every future user of a commercial product.
In short, (b)(2) is real, and the Model Rules don’t have it. It’s mostly good for the procedural, public-record half of the work. It won’t reach the privileged core of a matter. Comment [4] will, because a hypothetical that passes the test isn’t a revelation at all.
And I’ve got skin in how Opinion 26 reads: this firm uses these tools on client work, and a narrower rule would cost it money.
The half everybody misses
Names are the easy half. Find-and-replace handles them, and it’s the half most people check.
“The situation involved” is the hard half, and it fails without a single name in the text. Take a fact pattern — everything in this paragraph is made up — about a woman who ran the night shift at the only commercial laundry in a county of about seven thousand people, got let go nine days after she reported a chemical burn, and was offered $11,400 to sign a release. There’s no name in that sentence. Everybody in that county knows who she is. So does anybody who reads the complaint once it’s filed, because a filed complaint is a public document, and a fact pattern that matches one has been identified.
The research on this is old, and it hasn’t gotten any better with age. Latanya Sweeney’s 2000 working paper at Carnegie Mellon, using 1990 Census data, found that “87% (216 million of 248 million) of the population in the United States had reported characteristics that likely made them unique based only on {5-digit ZIP, gender, date of birth}.” Swap the ZIP code for the city and the figure was 53 percent. Swap it for the county and it was still 18 percent. Her summary: “In general, few characteristics are needed to uniquely identify a person.” Three fields. A legal fact pattern routinely carries a dozen.
Federal health-privacy law ran into the same problem and wrote down its answer, which makes it the best checklist a lawyer has, even though it doesn’t govern our confidentiality duty. The HIPAA de-identification rule, 45 C.F.R. § 164.514(b)(2)(i), lists eighteen categories that have to come out. Three of them should reset your instincts about what counts as identifying:
- It strips identifiers not just of the individual but “of relatives, employers, or household members of the individual”. The employer’s on the list. In an employment case, the employer is often the whole situation.
- It strips “[a]ll geographic subdivisions smaller than a State,” county included, and “[a]ll elements of dates (except year) for dates directly related to an individual”.
- And it ends with a catch-all: “Any other unique identifying number, characteristic, or code”.
The rule’s other path, § 164.514(b)(1), has a qualified expert determine that “the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual”. Put that next to Comment [4]’s “no reasonable likelihood that the listener will be able to ascertain”. Two different professions wrote them, and they land in almost the same spot. The question is never whether a name is there. It’s whether the recipient, with whatever else it can reasonably get its hands on, can get to the person.
Legal work adds identifiers HIPAA never thought of. The court and the judge. The other side, when it’s a regional institution. Opposing counsel. An odd procedural history. An exact dollar figure that also shows up in a filing. The date a motion was heard. None of those is a name, and every one of them narrows the field faster than a first name would.
Three techniques, and how each one fails
Lawyers use the word “anonymize” for three different jobs. They break in different ways, and a competent pass uses all three.
| Technique | What it does | Reversible? | What it misses | What it costs |
|---|---|---|---|---|
| Redaction | Deletes the value | No | Relationships (who did what to whom); gaps that themselves signal (“[REDACTED] County”) | Any part of the analysis that needed the value |
| Pseudonymization | Replaces each identity with a consistent token, keeping a map in the office | Yes, with the map | The situation entirely; a tokenized fact pattern is still a fact pattern | Creates a map file that is now the most sensitive document in the matter |
| Generalization | Replaces an exact value with a category or range (“a five-figure severance,” “within two weeks,” “a rural county”) | No | Nothing, if done well; it is the only one of the three aimed at the situation | Precision, which sometimes is the answer |
The tokens in a pseudonymization map have to be meaningless. Initials, a client number, or a shortened last name aren’t pseudonyms. They’re abbreviations. HIPAA’s re-identification provision, § 164.514(c)(1), states the principle cleanly: a re-identification code must be “not derived from or related to information about the individual”. Random tokens, fresh for each matter.
Generalization breaks when the exact value drives the answer. If the question is whether a deadline has run, the date is the question. If it’s whether a claim clears a jurisdictional threshold, the dollar figure is the question. When the value that identifies the client is the same value that decides the issue, you’ve got three choices: compute that piece locally so the value never leaves the building, find a route other than Comment [4], or get the client’s consent.
My working rule is short. Pseudonymize identities. Generalize the situation. Redact whatever the task doesn’t need. Then read the result like a stranger would and ask whether you could find the client with it and a search engine.
Who, exactly, is the listener?
Comment [4] talks about “the listener”. In the hallway, that’s one colleague. With a model, it’s everyone the provider’s terms and the tool’s design let see the prompt, and that list is longer than it looks: the provider’s staff, to the extent the terms allow; whoever serves a subpoena on the provider, which I took up in The Discovery of Your Prompts; whoever breaches the provider; and, for a self-learning tool, whoever prompts it next year. Opinion 512 spells out that last listener at page 7: the tool “may disclose information relating to the representation to persons outside the firm who are using the same GAI tool.”
That’s why the phrase “a reader then or later”, in 511R’s standard as Opinion 26 quotes it, matters even though Minnesota rejected 511R’s conclusion. Minnesota’s Comment [4] doesn’t contain the words “then or later”. It doesn’t need them. For a self-learning tool the listener includes the future, and if you judge reasonable likelihood against today’s audience only, you’ve judged it against the wrong audience.
There’s a second trap in the word “listener”, and it’s easier to miss. The listener hears the whole conversation. Twelve prompts, none of them identifiable on its own, can add up to a fact pattern that is. The county comes up in the fourth turn, the employer’s industry in the seventh, the severance figure in the tenth. Each prompt passes. The session fails. Comment [4] asks what the listener can ascertain, and a model with the full transcript in its context window has all twelve.
The answer can put the name back
Scrubbing is about what goes in. What comes out is a separate problem, and it puts identity back in three ordinary ways.
You paste the answer into a working document that also has the real names, and that document goes somewhere the prompt never would have. You ask a follow-up that supplies the exact fact the first prompt generalized, because the answer was too general to use. Or the scrubbed exchange sits in a shared folder and later gets reused on another matter by somebody who doesn’t know where it came from. That’s exactly the inside-the-firm risk Opinion 512 describes at page 6, where information can reach others in the firm “because, for example, they are unaware of the source of the information and that it originated with a client of the firm.”
Re-identify on your desk, after the answer comes back, by the person who holds the map. Never in a follow-up prompt.
What you can’t anonymize
Some work is the specifics. Reviewing a full medical record, reading a discovery production for the one email that matters, summarizing a deposition, building a chronology from a client’s texts. Strip the specifics out and there’s no task left. For that work, Comment [4] is off the table, and (b)(2) rarely covers all of it. What’s left is local processing, which I covered in Running Models on Your Own Hardware, or informed consent.
Consent has a definition, and it takes a lot more than a signature. Rule 1.0(f): “‘Informed consent’ denotes the agreement by a person to a proposed course of conduct after the lawyer has communicated adequate information and explanation about the material risks of and reasonably available alternatives to the proposed course of conduct.” Comment [7] to Rule 1.0 adds: “In general, a lawyer may not assume consent from a client’s or other person’s silence. Consent may be inferred, however, from the conduct of a client or other person who has reasonably adequate information about the matter.” Opinion 512 at page 7 requires “particulars about the kinds of client information that will be disclosed, the ways in which others might use the information against the client’s interests, and a clear explanation of the GAI tool’s benefits to the representation”, and it’s flat about the shortcut: “merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient.” Humiston’s column said it in one line: “Generic, boiler-plate language in engagement agreements is an insufficient way to obtain informed consent.”
One phrase in Rule 1.0(f) has quietly changed meaning this year: “reasonably available alternatives”. When you talk to a client about sending a full record to a hosted model, you have to explain the alternatives, and running it locally isn’t exotic anymore. Apple’s new desktops start at $899, as I wrote in Apple Just Priced the Local Thesis. I read “reasonably available alternatives” to require telling the client the work could be done on a machine in the office, what that would cost, and what it would give up. Get consent without mentioning that alternative and you don’t have the consent Rule 1.0(f) describes.
And the vendor doesn’t drop out just because the client said yes. Rule 5.3’s Comment [3] names “using an Internet-based service to store client information” as an example of using nonlawyers outside the firm, and it ties your diligence to, among other things, “the terms of any arrangements concerning the protection of client information; and the legal and ethical environments of the jurisdictions in which the services will be performed, particularly with regard to confidentiality.” Anonymizing shrinks what the vendor holds. You still have to read the terms for anything identifiable that goes.
Intake, closed files, and your test set
Intake. Rule 1.18(b): “Even when no client-lawyer relationship ensues, a lawyer who has consulted with a prospective client shall not use or reveal information obtained in the consultation, except as Rule 1.9 would permit with respect to information of a former client.” Opinion 512, at page 6, notes that the Model Rules “require lawyers to extend similar protections to former and prospective clients’ information.” An intake form that pipes a prospective client’s story straight into a hosted model to be summarized or scored is putting 1.18 information into that model, a lot of the time before anybody at the firm has read it. Intake is the easiest place in the firm to scrub automatically, or to keep entirely local, because the job downstream (is this a case we take?) rarely needs the name at all.
Closed files. Comment [19] to Rule 1.6: “The duty of confidentiality continues after the client-lawyer relationship has terminated.” A closed file isn’t a free pile of examples.
Test sets. I’ve argued in How Do You Know It Works? that every firm routing work to a model needs a labeled set of real examples to measure against. The best source of real examples is your own files. Inside the firm, Comment [5] lets lawyers share client information “in the course of the firm’s practice” unless the client has confined it. The minute that set goes to a vendor for benchmarking, into a shared repository, or into a published article, it has to meet Comment [4]. Build it anonymized from day one. Retrofitting is where things slip.
Comment [8] to Rule 1.1 asks lawyers to keep up with “the benefits and risks associated with relevant technology”. I read that to include knowing the difference between removing a name and removing an identity. If you think a find-and-replace anonymized a fact pattern, you’ve misunderstood the risk of the technology you’re using.
Required, prudent, and neither
Here’s what to say instead of “probably required”.
| Status | What | Authority |
|---|---|---|
| Required by rule text | No knowing revelation of information relating to the representation, absent an exception | Rule 1.6(a), (b) |
| Required by rule text | Reasonable efforts against inadvertent or unauthorized disclosure or access | Rule 1.6(c); Comment [17] |
| Required by rule text | Reasonable efforts to ensure outside services are compatible with the lawyer’s obligations | Rule 5.3; Comment [3] |
| Required by rule text | Prospective-client information protected even if no representation follows | Rule 1.18(b) |
| Required when you rely on consent | Adequate information, material risks, reasonably available alternatives; consent not assumed from silence, in general | Rule 1.0(f); Comment [7] |
| The ABA’s reading, advisory | Informed consent before inputting representation information into a self-learning tool; boilerplate insufficient | Opinion 512, p. 7 |
| Where Minnesota departs | Non-privileged, non-inviolate, non-harmful information may be revealed without consent | Rule 1.6(b)(2); LPRB Opinion 26 |
| Not required by anything I found | Anonymization as such | None |
| Prudent | De-identify to the Comment [4] standard by default for any outside tool; keep what cannot be de-identified local, or obtain real consent | Comment [17] factors |
In short: anonymization isn’t required. It’s the only route that works whether or not the information is privileged, whether or not it would hurt the client, and whether or not the client has signed anything. That makes it the most valuable of the four routes. It’s still optional. And the test it has to meet is already written down.
The best argument against me
The best argument against all of this is that anonymization is theater. Sweeney showed three fields identify most Americans. Re-identification is a mature discipline. A lawyer who thinks he’s anonymized a fact pattern is more dangerous than one who knows he hasn’t, because the first one stops being careful. On that view the only defensible choices are local or consent, every time, and “de-identified” is a word that lets lawyers skip both.
I’ll give them most of that. Sweeney’s numbers are real, the situation half is hard, and a fact pattern that looks anonymous to the lawyer who wrote it can read like a headline to anyone who lives in the county.
I don’t buy the conclusion. The standard is “no reasonable likelihood”, not impossibility, and Comment [4] has always lived with a little leftover risk for the hypothetical you kick around with a colleague over lunch. HIPAA’s expert path asks for a risk that’s “very small”, not zero. Consent-every-time turns, in practice, into the boilerplate that Opinion 512 and Humiston’s column both say fails. And local-only is the right call for some matters, but it gives up the best reasoning available on the hard part of the work, and that costs the client too.
So the objection earns a test, not a ban: if you can’t say, specifically, why a stranger with the prompt and a search engine couldn’t find the client, you haven’t anonymized. You’ve redacted.
What would change my answer
- A Board opinion on generative AI that adopts Opinion 512’s consent requirement without regard to Rule 1.6(b)(2). That would narrow the Minnesota-only route and make Comment [4] the only way around consent short of the client’s signature.
- Vendor terms that change the self-learning premise. Opinion 512 says so itself in footnote 34: “As the technology develops, the risks may change in ways that would alter our conclusion.” If hosted tools stop learning from inputs as a category, this whole question moves toward ordinary implied authorization under 1.6(b)(3).
- A disciplinary decision treating a scrubbed prompt as a revelation under the first sentence of Comment [4]. That would tell us where Minnesota draws “reasonably lead to the discovery”, and it would draw it on real facts.
- An amendment to Comment [4]. The comment is the test. If the Supreme Court rewrites it, everything above gets rewritten with it.
Sources
- Minn. R. Prof. Conduct 1.6 — paragraph (a) (prohibition); (b)(1)–(3) (consent; the non-privileged, non-harmful exception; implied authorization); (c) (reasonable efforts); Comment [3] (scope, “whatever its source”); Comment [4] (the hypothetical test); Comment [5] (implied authorization; disclosure within the firm); Comment [17] (reasonableness factors); Comment [19] (duty survives termination)
- Minn. R. Prof. Conduct 1.0 — paragraph (f) (definition of informed consent); Comment [7] (consent generally not assumed from silence; may be inferred from the conduct of a reasonably informed client)
- Minn. R. Prof. Conduct 1.1 — Comment [8] (benefits and risks of relevant technology)
- Minn. R. Prof. Conduct 1.18 — paragraph (b) (prospective-client information)
- Minn. R. Prof. Conduct 5.3 — Comment [3] (Internet-based services as nonlawyers outside the firm; terms and jurisdiction)
- Lawyers Professional Responsibility Board, Opinion No. 26 (adopted Jan. 20, 2025) — ABA Formal Opinion 511R “not applicable” in Minnesota because of Rule 1.6(b)(2); the Board’s quotation of 511R’s “then or later” standard
- Lawyers Professional Responsibility Board, Opinion No. 1 — force and effect of Board opinions; active opinions list
- ABA Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512 (July 29, 2024) — p. 6 (confidentiality framework; self-learning risk; inside-the-firm risk; former and prospective clients); p. 7 (consent required for self-learning tools; content of informed consent; boilerplate insufficient; idea-generation carve-out; footnote 34)
- Susan M. Humiston, Ethics guidance for generative AI use, Bench & Bar of Minnesota (Sept. 2024) — Opinion 512 as instructive in Minnesota; consent reading; boilerplate insufficient
- 45 C.F.R. § 164.514 — paragraph (b)(1) (expert-determination standard); (b)(2)(i)(A)–(R) (the eighteen identifier categories, including relatives, employers, and household members); (c)(1) (re-identification codes not derived from the individual’s information). Cited as an analog; it does not govern lawyers’ confidentiality duties
- Latanya Sweeney, Simple Demographics Often Identify People Uniquely, Carnegie Mellon University, Data Privacy Working Paper 3 (2000) — abstract, p. 2 (87% / 53% / 18% uniqueness figures on 1990 Census data)
- Companion essays in this section: Running Models on Your Own Hardware, The Discovery of Your Prompts, How Do You Know It Works?, What You Owe the Client You Automated, and Apple Just Priced the Local Thesis
General commentary on the Minnesota Rules of Professional Conduct and legal technology. Not legal advice and not ethics advice; for an opinion on your own facts, the Office of Lawyers Professional Responsibility runs an ethics hotline. Formal Opinion 512 is advisory and binds no jurisdiction, and Board opinions do not bind the Minnesota Supreme Court. The fact pattern above is invented. No client information appears in this article.