Privilege by Email: How Ordinary Messages Waive Attorney-Client Protection

A general counsel forwards a two-line memo from outside counsel to the head of sales: “Legal says we are fine on the pricing clause, go ahead.” She adds one sentence of her own: “Agreed, let’s push the launch.” Nine months later, in discovery, opposing counsel asks for that exact thread. The company claims privilege. The court reads the email, sees a business decision wrapped around a scrap of legal advice, sent to a business audience, and orders it produced. The advice that was meant to be confidential is now Exhibit 14.

Nothing dramatic happened. No one leaked anything. A careful, well-intentioned lawyer forwarded an email, the way people forward hundreds of emails a week. That is how privilege usually dies: quietly, in the outbox, one ordinary message at a time.

This is a field guide to that failure mode. It covers how attorney-client privilege and work-product protection actually work, the four everyday email habits that waive them, and a decision table your team can pin next to their screen. It is general information, not legal advice, and privilege rules vary by jurisdiction, so treat it as a way to spot risk earlier, then check the specifics with counsel.

What privilege actually protects (and what it does not)

Two separate protections get lumped together, and the difference matters when you are deciding whether an email is safe.

Attorney-client privilege covers confidential communications between a client and a lawyer made for the purpose of seeking or giving legal advice. Every word of that definition is load-bearing. The communication has to be confidential (kept within the circle that needs to know), between a client and a lawyer (or someone acting at the lawyer’s direction), and for the purpose of legal advice. A lawyer forwarding a market rumor, negotiating a lunch order, or offering a business opinion is not giving legal advice, and privilege does not attach just because a lawyer is on the thread.

Work-product protection is broader in one way and narrower in another. It covers materials prepared in anticipation of litigation, including a lawyer’s analysis, mental impressions, and strategy. It can survive some disclosure that would break attorney-client privilege, but it only exists once litigation is genuinely anticipated. A routine compliance review is usually not work product. A memo written because a claim letter just arrived usually is.

The practical takeaway: privilege is a status an email earns by meeting conditions, and it is a status the sender can strip away by breaking any one of them. Most waivers are self-inflicted.

The four ways an ordinary email waives privilege

1. Copying a third party

The confidentiality requirement is unforgiving. The moment a communication reaches someone outside the privileged circle, the “confidential” element fails, and courts routinely treat that as a waiver. The usual offenders are a personal Gmail address on the thread, an external consultant or PR firm added “for context,” a spouse, or a friendly contact at another company in a joint venture where the two firms do not share a common legal interest.

Auditors and accountants are a frequent trap. Looping in the outside audit team on a memo about a legal exposure feels responsible, and it can hand the other side an argument that the analysis was never truly confidential. The fix is boring and effective: keep the legal thread inside the privileged circle, and give third parties a separate, non-privileged summary written for their purpose.

2. Forwarding legal advice to a business colleague

This is the opening scenario, and it is the most common leak of all. Legal advice that sits quietly in a lawyer-to-client thread is protected. The same advice, forwarded to a wider business audience so people can “act on it,” starts to look like a business communication that happens to mention law. Courts look at the dominant purpose. When the email exists to drive a commercial decision, and the legal content is along for the ride, privilege is at risk for the whole chain.

Forwarding also breaks confidentiality by widening the circle. Each new recipient is another person who has to have a genuine need for the legal advice. “Everyone on the deal team” is not the same as “everyone who needs the legal advice to do their job.”

3. Mixing legal advice with business commentary

A single email that says “Legal thinks the indemnity is enforceable, and by the way we should lowball them on price and I think their CFO is bluffing” is a gift to opposing counsel. The business commentary is discoverable, and once a court has to untangle the two, the privileged portion is exposed to challenge and sometimes to production. Blended emails also make redaction expensive and unconvincing, because a redacted business email that is 80 percent black bars invites a motion to compel.

Keep legal questions in one thread and commercial strategy in another. When advice and action have to travel together, put the legal request or answer at the top under a clear label, and keep the business reasoning in a separate message.

4. Loose “privileged” labels that do not hold

Stamping “Privileged and Confidential” on an email does not make it privileged. Courts look at substance, and a label applied reflexively to routine business mail actively hurts you: it signals over-designation, and once a reviewing court finds ten labeled emails that plainly are not privileged, it trusts the eleventh label less. Worse, a blanket footer that auto-appends the label to every outgoing message trains everyone, including a future judge, to ignore it.

The label should mean something. Use it when a message genuinely seeks or conveys legal advice within the circle, and leave it off routine business mail. A precise label used sparingly is far stronger evidence of intent than a footer sprayed across the whole domain.

The evidence that these emails become the case

Skeptics ask whether any of this matters in practice. It does, because informal messages are discoverable and they end up at the center of proceedings. In the wave of off-channel recordkeeping enforcement, the SEC and CFTC levied over EUR 2 billion in combined penalties across financial firms whose staff conducted business on unmonitored channels, and the ordinary messages on those channels became discoverable evidence. The lesson generalizes past recordkeeping rules: regulators and plaintiffs read what your people actually wrote, in the tone they actually used, and a message you assumed was protected is only protected if it met the conditions when it was sent.

Privilege waiver is the quieter cousin of that story. No headline penalty attaches to the waiver itself. The damage shows up later, when the one document you needed to keep confidential is the document the other side gets to quote back to the jury.

The decision table: keeps privilege vs waives it

Print this. It is built for the moment before someone hits send, which is the only moment when the fix is free.

Situation	Privilege status	Safer wording or move
Lawyer answers a legal question inside the client circle	Keeps privilege	Leave as is. Label it plainly: “Legal advice, confidential.”
You add a personal email or an outside consultant to a legal thread	Waives (confidentiality broken)	Remove the external recipient. Send them a separate non-legal summary.
You forward outside counsel’s advice to the wider business team to “action it”	At risk (dominant purpose becomes commercial)	Do not forward the advice. Write: “Legal has cleared the pricing clause. Proceed.” State the decision, hold the reasoning.
One email mixes legal advice with negotiation strategy and personal opinion	At risk (blended, hard to protect)	Split it. Legal question in one thread, commercial strategy in another.
Routine business email carrying a “Privileged and Confidential” footer	Weakens all your real labels	Remove the auto-footer. Apply the label by hand, only when it is true.
Memo prepared after a claim letter arrives, kept within counsel’s circle	Keeps privilege and likely work product	Label it “Prepared at the direction of counsel in anticipation of litigation.”
Compliance self-audit with no litigation on the horizon, shared broadly	Usually not privileged	Assume it is discoverable. Write it as if a regulator will read it.
You cc a colleague at a partner firm on your own counsel’s advice	Waives unless a common legal interest is documented	Confirm a common-interest arrangement first, or send them their own analysis.

A rewrite in the shape the product uses

The high-value habit is small and repeatable. Take the forwarding case. The risky line reads: “Legal says we are fine, forwarding their full memo so you can all see the reasoning.” A safer phrase-level rewrite: “Legal has cleared this. Summary below; the full memo stays with legal.” Same decision reaches the team, the protected analysis stays in its circle. That is the entire move, and it is the kind of edit a person makes in three seconds once they can see the risk before sending.

Where a pre-send check fits

Training helps, but privilege waivers are attention failures, and attention is exactly what a busy lawyer runs out of at 6pm on a Friday. The person who forwards the memo knows the rule in the abstract. They just do not have the rule in front of them at the instant they hit forward.

A pre-send check closes that gap. VerbaPulse looks at a message before it leaves and flags the careless pattern a well-intentioned person did not notice: an external address on a legal thread, advice being forwarded into a business audience, a blended legal-and-commercial email. It offers a short, phrase-level safer version, and the person decides. It is a front-end shield for accidental human risk, and it is honest about its limits. It will not stop someone who has decided to leak, and it is not a security boundary against a determined adversary. It catches the ordinary mistake, which is where most privilege leaks live.

It also complements the tools you already run. Archiving and supervision platforms such as Smarsh and Proofpoint capture and review what has already been sent. A pre-send check sits one step earlier, so fewer waived-privilege emails reach those queues in the first place. Fewer problems downstream means a lighter review burden and fewer documents you have to fight over in discovery. For legal teams that want to go deeper on the mechanics and the workflows around this, our guide for legal teams on protecting privilege covers the setup in detail.

The takeaway

Do one thing this week. Turn off the domain-wide “Privileged and Confidential” auto-footer, and tell your lawyers and business partners to apply the label by hand, only to emails that genuinely seek or give legal advice within the circle. That single change strengthens every real privilege claim you will ever make, because it restores the label’s meaning. Then pin the decision table above where people draft, so the rule is in front of them at the moment they forward, cc, or blend. Privilege is lost in the outbox, so that is where you defend it.

This article is general information about how privilege can be waived and is not legal advice. Privilege doctrine varies by jurisdiction and by facts, so confirm the specifics with qualified counsel before relying on any of it.