"Bill Hartzer, Joy Hawkins, and Michael Merlino: Legal SEO, Local Ranking Mysteries, and Agentic Video Plays"

"Three Day 2 talks: Hartzer on expert-witness forensics and domain recovery, Hawkins on five measurement mysteries that quietly kill rankings, and Merlino on revenue-first agentic and short-form video plays."

This is the second block of Day 2, three back-to-back talks that move from the legal and forensic edges of SEO into hands-on local ranking diagnostics and revenue-first agentic workflows. Bill Hartzer (Hartzer Consulting, DNAccess) explains his work as an internet expert witness, the forensic toolkit for recovering stolen domains and proving ownership, and concrete prevention steps. Joy Hawkins (Sterling Sky, Local U) shares real client data on why ranking reports increasingly diverge from reality, why exact-duplicate location pages beat reworded ones, how to fix broken AI local packs, and a wave of stricter link-based core-update penalties. Michael Merlino (who also introduced himself on stage as "Mike Falino") delivers an off-the-cuff talk arguing rankings matter less than conversions, demonstrating a short-form UGC video play and pushing agentic workflows and social signals as the path to agency survival.

Main takeaways

1. An internet expert witness translates SEO, PPC, and domain mechanics for courts. Hartzer writes evidence-backed reports (screenshots, spreadsheets, analytics, log files), gets deposed, and testifies. Common case types are SEO/PPC disputes, online defamation, and domain name fights.
2. Forensic tools can unmask hidden owners and reconstruct history. DomainIQ (WHOIS history), Archive.org, Namebio (sales comps), PublicWWW (code search by tracking ID), and SecurityTrails (current and historical DNS) let you find every site in someone's analytics account or on a shared IP, even behind Cloudflare and WHOIS privacy.
3. Transferring a domain back to yourself without permission is a federal cybercrime. Even with the correct user ID and password, web designers and developers (and even the rightful owner) cannot simply move a domain. The correct path is recovery, then UDRP, then legal.
4. 5-year registrations and WHOIS turned off are ownership proof, not just hygiene. Hartzer recommends registering domains for 5+ years, turning WHOIS privacy off (use a company address), and using domain blocking services (NameBlock, GlobalBlock) so thieves cannot grab brand variations. A thief who steals a domain typically adds WHOIS privacy, which itself becomes evidence.
5. Ranking reports increasingly lie because Google surfaces have split. Hawkins shows that Maps vs Search, mobile vs desktop, and tool methodology (scraping vs Maps API vs Search) all return wildly different results. Service area business (SAB) listings rank poorly on Maps but fine on Search, so a Maps-based tracker can make you look like you are losing when you are winning.
6. Google is replacing call buttons with Local Services Ads in the local pack. Clicks-to-call have steadily declined (per a Jepto report) as call buttons disappear, while ads in the local pack climbed from almost never to roughly 30% of the time over a year (per Places Scout data). Call tracking, not visibility, is the non-negotiable metric.
7. Exact-duplicate location and service-area content outranks reworded content. Hawkins ran tests (prompted by Julius and a Kyle Roof quote): swapping only the city name on identical templates beat slightly-reworded pages. She grades pages, picks the most semantically relevant, and makes the rest word-for-word identical.
8. AI local packs are broken and easy to exploit (and to fix). Appearing on about 13% of (mostly US, mostly mobile) queries, they show 2 listings and often fail to connect to a GBP, leaving a blank pin. The fix is making the business name on the website match the GBP name exactly (even capitalization). Google shows the source it pulled from, and Yelp is a rising cited source to watch.
9. Link-based core-update penalties have gotten much stricter, and they are domain-wide. Hawkins is seeing established small-business and legal/home-services sites wiped out by dozens (not hundreds) of anchored links, often guest posts five years old. Penalties (classifiers) do not hit local pack rankings, only organic. Recovery takes at least two core updates (about six months) and is not guaranteed.
10. Merlino: stop optimizing for rankings, optimize for revenue with conversions and call tracking. He manages 250 of his own GMBs (zero client GMBs), tracks money-per-call in his own software (Bird's Eye ROI), and routes follow-up through AI agents.
11. Short-form UGC video (PAA plus geo) dominates the image, video, and short-video tabs. Take a People Also Ask question, add the geo, produce a 15 to 30 second UGC video with a face on camera and the full PAA as the thumbnail text, embed it on the relevant page, then syndicate across social. This ranks across multiple Google surfaces (organic/maps, AI mode, image/video tabs).
12. Social signals are now trust and prominence signals, and agentic workflows are survival. Merlino argues active social media is how Google reads trust and prominence, and that agencies failing to adopt AI/agentic workflows will lose on rising churn and falling client budgets.

Key points

Bill Hartzer (Hartzer Consulting, DNAccess)

Background and role

• Owns a one-member agency, Hartzer Consulting, and runs DNAccess, handling everything related to domain names. Doing SEO since 1996, blogging on his own name (BillHartzer.com) since around 2001.
• Former Senior VP at Advice Local; also Globe Runner, Standing Dog, Vizion Interactive. Founded the DFWSEM Association in 2004 and runs the State of Search conference annually.
• Brand ambassador for Majestic.com, Oncrawl, and SEMrush; judge for the US, UK, and Global Search Awards. Not an attorney; refers clients to domain/internet attorneys.

Expert witness work

• Currently about 10 ongoing related cases; March, April, and May are the big trial season. Process: review the case, request info from both attorneys, write a report with screenshots and spreadsheets, present to court, get deposed (sometimes 8 hours), and possibly testify at trial.
• Case types include SEO/PPC blame (an e-commerce redesign blamed for $100M to $400M in losses that was really caused by the AI Overviews rollout, proven with SEMrush timing data), online defamation (a YouTube creator inciting 8M followers; explaining parasocial relationships to judges), domain disputes, and brand confusion.

Named cases

• St. George Executive Shuttle v. Western Trails Charters & Tours LLC: Western Trails bid on the trademark "St. George Shuttle" and used it in ad copy; St. George (which holds the trademark) sued and won.
• Lab-testing lead-gen case: a lead-gen finder site (paid about $20 per lead) was sued after a lab employee (second day on the job) reused a used needle. Hartzer used Google Analytics to reconstruct the customer journey (date/time, pages, the online agreement clicked) to show the lead-gen site was not responsible.
• Whitespark example: the owner of whitespark.ca holds the "Whitespark" trademark; someone else holds whitespark.com running PPC ads and local-SEO content, a clear UDRP target (bad faith via competitor ads). (The Whitespark owner's first name is given inconsistently in the source as Darren or Garen, likely Darren Shaw.)
• Golf course case (Iowa): an expired domain had its old site re-posted from Archive.org with added sports-betting affiliate links, plus the old phone and old AOL email still on it, a problem for the new course owners (sports betting is illegal in Iowa). Hartzer found the affiliate (in California) via the affiliate ID in the link source code. (The course name is inconsistent in the source between the deck's "Terrace Hills" / TerraceHillsGolf.com and the spoken "Charis Hills.")
• Brand-confusion auto-suggest case: two month-long-training competitors, one in Arizona and one in California; the Arizona company manipulated Google Auto-Suggest to surface the competitor's name plus "Arizona."

Forensic tools

• DomainIQ: WHOIS history; each dated change shows when the record changed; can go back to pre-GDPR records (before registrars blanket-applied WHOIS privacy) to reveal the true owner if name servers/IP did not change. Search by name or email to find all associated domains.
• Archive.org: historical site snapshots; site owners can opt out (submit a support ticket and verify as owner). Counter-use: proving you owned or operated a site 10 years ago.
• Namebio: domain sales data, like real-estate comps; how much and when a domain sold, plus resale history.
• PublicWWW: a code search engine. Search a unique tracking ID (Google Analytics UA-12345-1, -2, etc., or Hotjar / Microsoft Clarity code) to find every site in someone's account, even across servers, defeating WHOIS privacy and Cloudflare. (Google will not let you search code; PublicWWW will.)
• SecurityTrails: current DNS/WHOIS (NS records, Google site-verification TXT files, server/IP). Click an IP to see every domain on that server. DNS history captures the original server even after a move to Cloudflare (a site often sits on its real server 1 to 3 days before moving).

Domain theft and recovery

• Threats: hacks and lost domains; insiders (employees, web developers, web designers); a single shared Gmail across many employees (one case: 27 employees on one Gmail tied to GoDaddy, domain went missing); dark-web passwords (Network Solutions was hacked ~10+ years ago, same user/pass still valid); the wrong email on WHOIS; and using the same company for registrar and hosting.
• Web designers and developers do not need registrar access at any time. Transferring a domain to yourself without permission is a federal cybercrime, even with valid credentials, and many designers/developers do not know this.
• Recovery speed: GoDaddy is slow (2 to 3 weeks minimum when things go bad, not recommended); other registrars often resolve transfers back within 24 to 48 hours.
• Hartzer gets about 15 inquiries per week about lost domains and has recovered 500+ domains in the past 2 to 3 years. Active case: a nonprofit (helping domestic violence victims and veterans furnish new homes) had all domains transferred to a rogue web designer; Hartzer filed a police report and is helping raise about $1,500 in UDRP filing fees.
• Recovery ladder: Step 1, attempt non-legal recovery (call the person; account recovery showing ID/company papers to the registrar). Step 2, forensic research (DomainIQ, WHOIS history, DNS). Step 3, legal (UDRP or lawsuit).

UDRP (ICANN policy), must prove all three

1. The domain is identical or confusingly similar to a trademark you have rights to.
2. The registrant has no rights or legitimate interests in it.
3. The domain was registered (or acquired, e.g., at an expired auction) and is being used in bad faith.

• Proving two of three is not enough; all three are required. Costs: up to $1,500 filing fee; choose 1 or 3 panelists (3 costs more). Filing bodies are WIPO, the National Arbitration Forum, and CAC (Czech Republic, runs in English, lower cost). A domain attorney runs $3,000 to $10,000+. The registrant's identity is revealed when the dispute is filed.

Prevention

• Monitor domain registrations and keywords (keyword and brand alerts, including free tools like Google Alerts). Limit registrar account access; use 2FA with a physical key where possible; enable Google Advanced Protection for Google accounts. Fabulous.com is cited as the most secure registrar (supports physical-key/U2F login), where Hartzer keeps most of his domains.
• Apply domain locks and executive lock, and register for 5+ years. See his post "7 Ways to Protect Your Domain Name" at billhartzer.com/domain-names/7-ways-protect-your-domain-name/.
• Domain blocking services: NameBlock and GlobalBlock (GlobalBlock.co is owned by GoDaddy, sold via resellers, free report). NameBlock blocks up to 500 variations; cheaper annually than registering defensive domains. Hartzer blocks "Hartzer" so no one can register, for example, hartzersucks.com (he has legitimate interest via hartzer.com even without a trademark).

Website legal issues

• Copyright/IP theft: content copied word-for-word, sometimes outranking the original; remedy via DMCA forms with search engines, web hosts, and registrars, though some non-US hosts will not comply.
• Expired domain exploitation: scraper tools rebuild old sites from Archive.org; the new owner does not own the copied content even if it is 10 years old.
• Google Ads: you can bid on any keyword (including trademarks like "Nike shoes") but cannot use trademarks in ad copy. Trademark owners can file a Google TM authorization form (support.google.com/google-ads/contact/3rd_party_auth_req) so Google blocks others from using the mark in copy.
• Online defamation: contact host abuse for site content; flag and report social posts; sometimes it goes to court. Brand confusion in his cases always involved a trademark; prove confusion with SEMrush query/volume data, Google Trends, and Similarweb. Image "theft" shows up as Higbee Law Firm letters.

Q&A

• He buys domains from bankruptcy and estate auctions, works with families of deceased owners, and uses legal account-recovery options. He has not encountered blockchain proof-of-ownership tokens and notes non-ICANN TLDs exist, but the official WHOIS record is still what people rely on for ownership.
• DMCA does not cover a competitor using your registered trademark in URLs or page titles; if your mark is in their domain and they registered it before your trademark existed, that is not bad faith and you are "out of luck"; if it is elsewhere in the URL or page content you can demand they stop.
• A "Joe's Plumbing" vs "Joe's Air Conditioning" (Dallas) confusion example: even without a US trademark, a well-known name can be a common-law trademark, with confusion provable via Google Search Console queries.

Joy Hawkins (Sterling Sky, Local U)

Framing

• Talk title: "Five SEO mysteries that secretly kill your ranking." Sterling Sky's T-shirt slogan: "My data doesn't care about your opinions." Doing local SEO since 2006; runs Local U (a Dallas event in October). Sterling Sky is "always hiring" (SEO, PPC, social).

Mystery 1: Competitor review surges Google never penalizes

• A Tampa personal injury lawyer client's competitor jumped from about position 8 to the top 3 within weeks because reviews went from just over 400 to over 500 almost all on the same day.
• The tactic: give out free bicycle helmets to kids at a local festival, then ask for reviews (no signs requiring a review; reviewers post kids' photos). Google said it violates guidelines but did nothing.
• Hawkins tracked them 5 to 6 months: rankings held the top spots even after new reviews stopped, and they repeat the boost once or twice a year. Brad Weatherall (ex-Google, 10 years) said whether a Googler approves these reviews is "a coin flip." Her client (state bar rules) declined to copy it, but Hawkins believes the revenue gain outweighed any future removal.

Mystery 2: Measuring leads and traffic incorrectly

• The same client's Local Falcon report differed from her team's Places Scout report. Cause: Local Falcon searches Google Maps; Places Scout searches Google Search, and the two surfaces give very different results.
• Service area business (SAB) listings (no directions icon, for home-based businesses) rank poorly on Maps but fine on Search. Example: two locksmiths in the top 3 on Search were positions 6 and 11 on Maps. Tool providers are split (Google Search, scraping, or Maps API), so results differ.
• Mobile vs desktop now diverge (more in the last two years). Same search, same location, same time: desktop showed a 3-pack of three lawyers; mobile showed two lawyers plus an AI local pack.
• Google is removing call buttons from Google Business Profiles. A Jepto report showed clicks-to-call steadily declining over two years. Per Places Scout data, ads in the local pack went from almost never at the start of the year to nearly 30% of the time by year-end, swapped in where the call button was. ("You now know why Google's earnings are up.")
• What to track: Google Business Insights/performance data shows where traffic comes from (Maps vs Search; usually Search mobile wins). Call tracking is becoming non-negotiable; visibility is misleading.

Mystery 3: Duplicate beats spun content

• Prompted by Julius (met in a London mastermind), who found duplicate content outperforms spun content on lead-gen sites, and by Kyle Roof's point that AI content is bad at putting the exact words you need to rank into the content.
• Local businesses fear duplicate content on service-area/location/city pages and reword them; Hawkins argues that hurts them. Reference client (acquired 9 years ago): about 30 service-area pages from a template targeting Toronto-area cities, swapping only the city name, content about 80% identical, ranked extremely well and still does. Home Depot analogy: thousands of location pages with the same content, no rewording.
• Method: use an internal tool (or Kyle Roof's tool) to grade pages by semantic relevance, pick the best, then make all other service-area pages word-for-word identical to it. Rankings shot up across multiple tests. Disclaimer: untested at scale (e.g., 3,000 pages); things can break at scale.

Mystery 4: AI local packs

• Hawkins's term "AI local packs." US-only, mostly mobile, showing on about 13% of queries; display 2 listings (not 3), displacing the 3-pack, and appearing slightly on desktop.
• Mechanism: scrapes data from various sources and tries to connect to a GBP, but frequently fails, leaving a blank pin (no photos, reviews, details, or hours). Seen heavily for lawyers, garage door repair, and some medical practitioners.
• Example: Abrams & Mayo Law Firm; the current legal name is "Abrams Law Firm LLC" but the website says "Abrams & Mayo Law Firm," so Google's AI cannot match and connect the GBP.
• Fix: make the business name on the website match the GBP name exactly, including capitalization (one client connected only after both were put in all caps). This is not a NAP/citation consistency issue; it is mostly your website. Google shows the source link for each item (click the tiny link button to see where it pulls from). New trend (last month): Yelp showing up as a top cited source.

Mystery 5: Stricter, domain-wide link penalties (core/spam updates)

• Many established small-business and legal/home-services sites are getting traffic wiped out and do not know why. Lily Ray (interviewed on Hawkins's podcast) confirmed core updates are getting harsher and the penalty threshold is getting stricter. Established-brand crashes are new (lead-gen and affiliate crashes were always normal).
• Analysis method: in Search Console, remove branded terms and remove the GBP URL (use a negative UTM filter); otherwise the crash is hidden by branded/local pack traffic. Three patterns: (1) Google usually warns first with a big drop at an earlier update (e.g., June or August spam update), then the December core update kills the whole site after months of decline; (2) declines visible on weekly graphs; (3) classifier sites that do not recover.
• Cause is links, not AI content. Common culprits: anchored links (e.g., "best plumber in Dallas"), guest posts (top of the list), business-network links, and PBNs. The threshold is dozens of anchored links, not hundreds; the killing links are often about 5 years old.
• Attribution: a single keyword crashes that exactly matches an anchor text; pull all links with that anchor; check whether other sites linked on the same pages are also crashing at the same time; referring domains rising while organic crashes (the two graphs diverging) signals a link scheme.
• Client example: bought about 400 links from a popular link-building company in 2021 to 2022. In 2023, core updates undid the gains repeatedly (so you keep buying more, "chasing"); in the last year Google now wipes the entire linked page from ranking, while new zero-link pages on the same site rank fine.
• Penalties (classifiers) do not affect local pack rankings, only organic. The "classifier" concept came with the 2023 Helpful Content Update (HCU); Glen Gabe has horror stories. With a site-wide classifier, nothing you do raises traffic until it is removed. Counterexample: a bail bonds site with hundreds of exact-match anchors is dominating and even rose with the March update because Google has not caught its network yet (do not assume it stays fine).
• Recovery: actively working to recover about 6 sites; the minimum to clear a classifier is usually two core updates (about 6 months), best case, with a new domain as the worst case. Tim Callahagan (Facebook group owner) saw some recover in December that were hit in June. Tooling: a Chrome extension (name not given) draws update lines on weekly Search Console graphs; disavow files (she filed one in her whole career before, now testing many).
• Closing advice: doing the right things no longer guarantees good outcomes; catch patterns early, question assumptions, and adapt faster.

Michael Merlino (also "Mike Falino")

Self-positioning

• Profane, slide-light, off-the-cuff; says he does not make his own slides (a teammate does); has ADHD/OCD/dyslexia; from Brooklyn. Manages 250 of his own GMBs and zero client GMBs ("My shit").
• Runs an agentic setup; mentioned "agents, OpenClaw, and Hermes running" (phonetic, unverified). A teammate Elias (from Macedonia) built his bots (local guides bots, review bots, GMB bots). Agents monitor RSS feeds and sitemaps for any new SEO article, digest it, and test at scale if worth it.
• His company is Pocket Marketer (a session sponsor), co-founded with his partner Daniel; he is a CMO by trade and built it for "second-act entrepreneurs." Team went from 27 to 15 people, with more cuts warned unless he finds new roles; long-tenured staff who adopted AI now "whip up shit."

Revenue over rankings

• "It's not about the rankings. It's about the conversions." Says he has not looked at a geo grid.
• Built his own call-tracking software, "Bird's Eye ROI" (phonetic, not for sale): logs money-per-call per day; sends calls to networks plus his own jobs; the UI shows an emotion icon for a quote amount (e.g., $7,500), a credit card for a taken deposit, a megaphone box for a quote only, and a calendar for a booked in-house estimate. For a missed call, he presses a button and an agent named "Hawkeye" opens a follow-up email or call.

Short-form UGC video play (his core tactic)

• Take a PAA (People Also Ask) question and add the geo; target local, not national. Produce a 15 to 30 second UGC video that answers the question with "the intent behind the intent," heuristics, and the offer.
• It ranks in the image tab, video tab, and short-video tab; if the SERP is weak enough, it ranks fast. Thumbnail secret: put the FULL PAA question as text on the thumbnail; the UGC face/clip can be small in the corner. Google must see a face on camera (AI or real) because it is weeding out spammers and expects real-person content.
• Then embed the video on the relevant page (Google ranks pages, not websites), syndicate through social, and add to a podcast. Case-study channels on YouTube: "H Town Plumbers" and an NYC local-SEO one. Example: "most common water heater problem in Houston" ranking in video and short-video tabs (one video had about 1.2K YouTube views). With enough engagement, the content starts showing up in the AI Overview.

Knowledge panel stacking and the Maps share link

• "Knowledge panel stacking" / "KP stacking" (a term he may have coined): stacking multiple knowledge panels as signals to Google; each GBP gives a unique identifier (he is unsure whether MID, place ID, or CID). He used to spin up software for video citations and get 100 knowledge panels in a day; the same plays are less effective now.
• The "MIB" link (phonetic; the Google Maps share/viewer link with CID/place ID parameters): when you click a listing's Google link, if the business is active on social, its social profiles show up there. Demonstrated live (the link format changes; "Google's always changing").
• Audience-validated theory (from an attendee's old blog): each of the three map listings has a numeric ranking score, and to get a solo knowledge panel for a keyword instead of the 3-pack you need roughly 2.5x the score of the number-two listing. Merlino confirmed his knowledge-panel dominance works this way.

AI Overview entry read and social signals

• He can judge in seconds whether he can get into an AI Overview: if there are not all top-level/authority domains, or if any social, Reddit, or the Google-Maps share link is present, he can get in. Calls it "forensic science" and references RAG systems and whether the sourced sites can be manipulated or bought.
• "Trust, prominence, trust, prominence." Social activity is how Google reads trust and prominence; a business with only a website and GBP but no Facebook/Instagram/TikTok/citations and no field content (before/afters) loses to active competitors. Diagnostic: when you cannot tell how a competitor ranks despite a clean audit, check their social media; they will be very active on at least one platform.
• Reddit: add a PAA with a Reddit post, no links, drop value, brand mentions ("Reddit is about value"). He also uses Quora daily and Facebook groups. HVAC aside: "HVAC" is a vanity keyword; focus on actual service terms and know all the sub-services or you do clients a disservice.

Agency survival warning

• Adopt AI/agentic workflows or get left behind; the first symptom is heavy payroll because churn is up, clients are down, and clients want to spend less. Do not simply replace humans (he calls that unethical); retrain low-level workers ("get on the ship or I'm leaving without you"). He also floats building an AI clone of a camera-shy client for outreach and retention.

Speaker name note: the third speaker is introduced from the floor as "Michael Merlino," yet he self-introduces mid-talk as "Mike Falino." Both refer to the same speaker; the canonical/billed name is treated as Michael Merlino. Several tool and product names spoken by Merlino are phonetic transcriptions and unverified (OpenClaw, Hermes, Bird's Eye ROI, Hawkeye, and the "MIB" Maps share-link identifier). Some names and the golf-course name are given inconsistently in the source and are marked above.

Slides

Only Bill Hartzer supplied a deck export ("Legal SEO and Domain Name Issues"). Joy Hawkins and Michael Merlino presented from live slides, and no deck files were provided for them.

Slides (42)

Source

Synthesized from the SEO Spring Training 2026 conference recording (Day 2, Part 2) and the Bill Hartzer deck, "hartzer-seospringtraining-apr2026" ("Legal SEO and Domain Name Issues"). No deck files were provided for the Joy Hawkins or Michael Merlino talks. Some details (speaker name spellings, phonetic tool/product names, and one golf-course name) are marked as unverified or inconsistent where the source did not confirm them.