CerteCerto · certecerto.com
5-Star Privacy Snapshot · Teaser Preview

MLF Legal PLLC

Texas · Dallas–Fort Worth · Workers’ compensation / personal injury · WordPress + Elementor + Mailchimp · Not legal advice
Compliance status
HIGH COMPLIANCE RISK
Firm / attorneys
MLF Legal PLLC · Matthew Lewis, Daniel Morris
Website
mlflegal.com
Contact (live)
(214) 357-1782 · intake@mlflegal.com
Audit date
October 13, 2026 (CT)
Audited source 1: Homepage / forms
mlflegal.com/

“MAKE CONTACT” form, Mailchimp newsletter, ebook downloads, no Privacy Policy link. Tags: Meta Pixel 810694636354226, AW-365475497 + 3 more Google Ads IDs, G-V8XQ94NPSD, G-X0K2967Z3N, Bing UET, Microsoft Clarity, Hotjar 3621931, YouTube. HTTP 200, live Chrome check October 13, 2026.

Audited source 2: Contact / appointment page
mlflegal.com/contact-mlf-legal/

“BOOK APPOINTMENT” form with “Tell Us About What Happened”, no notice at the form. Hotjar and Clarity session recording active. No cookie banner. HTTP 200, October 13, 2026.

Audited source 3: Legal pages
mlflegal.com/privacy-policy/

No visible link to any privacy, terms, cookie, or accessibility page. Schema markup references /privacy-policy/, but the site’s Wordfence firewall returned 503 to our checker for that and other inner URLs, so its contents are unverified. Checked October 13, 2026.

4
Critical gaps
3
Warnings
10
Tracking tags w/o consent
127
axe failures (2 pages)
Executive pitch

mlflegal.com asks injured workers to “Tell Us About What Happened” while Hotjar and Microsoft Clarity session recording run on the same page, next to the Meta Pixel, Bing UET, two GA4 properties, and four separate Google Ads accounts. None of it waits for consent, there is no cookie banner, and Global Privacy Control is ignored. No Privacy Policy is linked anywhere on the homepage or contact page, even though the site collects data through two intake forms, a Mailchimp newsletter, and ebook downloads. The forms carry no notice at the point of collection, and axe found 127 accessibility failures on just 2 pages.

2026 → 2027 exposure

Do now (2026): publish and link a Privacy Policy; remove session recording from intake pages and mask inputs; add a consent manager that honors GPC; add confidentiality notices at both forms; consolidate ad accounts; add newsletter consent wording; fix the WCAG 2.2 AA failures. Conditional: Texas TDPSA rights. 2027: a bilingual legal hub that matches the live tags and forms.

Executive key takeaway

The biggest risk: two session-recording tools and four ad platforms run on the page where injured workers describe what happened, with no consent, no GPC support, and no Privacy Policy linked anywhere to tell them. The full report unlocks the exact replacement language for all 4 critical and 3 warning findings, plus the 2027 roadmap item, along with the 8-step roadmap.

Free preview: finding 1 of 8

2026: No Privacy Policy is linked anywhere on the homepage or contact page, while 10 tracking tags and 4 forms collect data

2026 GAP
Privacy notice · Transparency · FTC Section 5 · Active 2026 finding
Current state (verified October 13, 2026 CT)
Live Chrome load of mlflegal.com/ and /contact-mlf-legal/: there is no link containing “privacy,” “terms,” “cookie,” or “accessibility” on either page. The footer reads, in full order: “Areas of Practice … About · Who We Are · Contact us · Blog · Videos · Downloads · Workers' Comp Free Ebook · Social Security Free Ebook · Follow Us On … Matthew Lewis · Daniel Morris · © All rights reserved 2026 MLF Legal · Made by PCMG”. The pages collect data through a “MAKE CONTACT” form, a “BOOK APPOINTMENT” form, a Mailchimp “Newsletter Sign-up,” and free ebook downloads, none of which links a policy. The site’s schema markup points to https://mlflegal.com/privacy-policy/ as its ethicsPolicy, but nothing visible links to it, and our checker was blocked by the site’s Wordfence firewall when requesting that URL, so whether a policy page exists there could not be confirmed.
Requirement
A site that collects contact details and runs advertising and session-recording tags should link a privacy notice from every page, describing what it collects and which vendors receive it.
Exact language / corrective action that should be there
Footer link on every page: “Privacy Policy”. Policy opening: “Privacy Policy — MLF Legal PLLC. Effective date: [Month Day, 2026]. Who we are: MLF Legal PLLC, (214) 357-1782, intake@mlflegal.com. What we collect: your name, email, phone, appointment date and time, the type of legal help you need, what you tell us about your work injury, newsletter and ebook sign-ups, and device/usage data. Tools we use: Google Analytics 4, Google Ads conversion tracking, Meta (Facebook) Pixel, Microsoft Advertising (Bing) UET, Microsoft Clarity and Hotjar session recording (set to hide what you type), YouTube, Google reCAPTCHA, and Mailchimp. We do not sell personal data.”
Recommended fix
Publish (or relink) a dated Privacy Policy in the footer of every page and next to each form, the newsletter box, and the ebook downloads.

Get the full MLF Legal Privacy Snapshot

7 more findings with live evidence and word-for-word replacement language, plus the 8-step 2026–2027 roadmap.

Privacy Snapshot
$1,000
  • Full report, delivered in 1 business day
  • Ready-to-upload policy pages (Privacy, Cookie, SMS, Accessibility)
Website Upgrade
$2,000
  • Full report and policy pages
  • New accessible (WCAG 2.2 AA) website, delivered in 5 business days
  • Up to 2 rounds of revisions
Get the full report →