Jump to section
You draft a settlement offer in Word, tighten the number twice, delete a paragraph your senior partner told you to cut, and email it to opposing counsel. Looks clean. Reads clean. But riding along inside that file is a quiet record of everything you just did: the earlier numbers, the deleted paragraph, the name of the associate who started the draft, and the folder it lived in. That hidden layer is metadata, and it has caused real problems for more than a few firms.
This is a plain explainer. No panic, no jargon. Just what metadata is, how it has actually hurt lawyers, and the small habits that keep it from hurting you.
The Data You Cannot See in a Document
Metadata is data about data. It is the information a program stores about a file that is not the visible content itself. Open a document and you see the words. Underneath, the software has been keeping notes.
Depending on the file type and the program, that hidden layer can include:
- Author name, and every person listed as a co-author or last editor
- Creation date, last saved date, and total editing time
- The file path or template it was built from, sometimes exposing a client name in a folder
- Earlier versions of text through autosave or fast-save data
- Comments, tracked changes, and hidden text
- Custom properties your firm or your document system stamped on it
None of this shows up when you print or when you glance at the page. That is exactly why it is dangerous. You are reviewing the words while the file is carrying a second story you never read.
Note. Metadata is not a bug or a virus. It is a normal, useful feature. The problem is not that it exists, it is that we forget it travels with the file.
Tracked Changes and Comments That Follow the File
The most common leak is the simplest one. Tracked changes and margin comments do not disappear when you hide them from view. Turning off the display of markup only stops it from showing on your screen. The revisions are still in the file, and one click on the other end brings them back.
Picture the internal comment "we can go lower, this is our opening position" sitting in a document you send to the other side. Or a tracked deletion that shows the clause you quietly removed after a client instruction. The recipient does not need to be clever. They just need to open the review pane.
Comments are worse than the visible text because they are candid. They are where the real strategy lives, written for colleagues, never meant for outside eyes. When those follow the file, you have not just leaked a number. You have leaked your thinking.
The document says what you decided. The metadata says how you got there, and sometimes that is the part you least want to share. On document handling
Real Cases Where Metadata Caused Harm
You do not have to look far for the pattern. Over the years, firms and companies have handed opposing parties, journalists, and regulators more than they intended, all through metadata that nobody scrubbed.
Common versions of the story look like this:
- A redacted court filing where the black boxes were only drawn on top of the text, so copying and pasting revealed the names underneath.
- A public policy document where tracked changes exposed which lines an outside party had quietly edited, contradicting the official position.
- A negotiation draft that shipped with comments revealing the sender's walk-away number.
- Author fields that outed the true source of a document that was presented as independent.
The details differ, but the mechanism never changes. Someone treated the visible page as the whole document. It was not. If you want a broader view of how confidentiality slips through everyday tools, our note on client confidentiality with cloud tools covers the same instinct applied to shared drives and links.
Warn. A redaction that hides text on screen but leaves it in the file is not a redaction. It is a delay. Always flatten redactions so the underlying text is truly gone.
How to Clean a File Before You Send It
The fix is a short routine, not a significant effort. Build a short routine and run it every time a document leaves the firm for an outside party.
- Accept or reject all tracked changes. Do not just hide the markup. Resolve it so there is nothing left to reveal.
- Delete every comment. Clear the comment pane entirely rather than trusting that they are hidden.
- Run the built-in inspector. Word, for example, has a Document Inspector that strips author names, hidden text, and other properties in one pass. Use it.
- Check the file path and custom properties. Make sure a client name or matter code is not sitting in a template field.
- Do a final read of the actual final version. Open what you are about to attach, not the draft you think you attached.
Where possible, let your systems carry some of this load. A tidy document workflow, with clear versions and a sensible place for internal notes, reduces the odds that private markup ever reaches an outward-facing draft. If you are rethinking how files move through your practice, choosing a document management approach and templates and automation with control are good companions to this post. Tools like the Document builder in A1 CMS are built to keep working notes separate from what a client or a court actually sees.
When to Send a PDF Instead
The single most reliable way to avoid a metadata leak is to not send the editable file at all. When the other side has no reason to edit your document, send a PDF.
A PDF is not automatically clean, and that surprises people. Convert carelessly and comments or hidden layers can carry through. But a PDF is far easier to sanitize, and most PDF tools have a one-step function to remove hidden information and flatten the file so nothing sits under the surface.
| Situation | Send as |
|---|---|
| Final letter, offer, or filing for reference | PDF, with hidden data removed |
| Draft agreement the other side will redline | Word, scrubbed of comments and tracked changes |
| Anything with redactions | PDF, with redactions flattened |
| Internal draft to a colleague | Editable file is fine, keep it internal |
The rule of thumb is short. If they need to edit it, clean the Word file. If they only need to read it, send a flattened PDF. Confidentiality is not only about who you send things to. It is about what quietly rides along.
Metadata is not exotic and it is not going away. It is just the ordinary bookkeeping your software does, sitting one click below the page you actually read. Treat every outbound document as if the recipient will open the hidden layer, because eventually one of them will. A two-minute scrub, a preference for PDFs, and a workflow that keeps your private thinking private will spare you the story you never want to tell a client. If security habits are on your mind more broadly, the wider legal tech and AI section and our firm-wide MFA guide pick up the thread from here.
