Email Signature Legal Requirements Around the World

GDPR, CAN-SPAM, the UK Companies Act, and other rules that affect what your business email signature must include — explained in plain English.

In most countries, business email signatures are not just a marketing convention — they are a legal requirement. The exact details vary by jurisdiction and by the type of email (one-to-one correspondence versus marketing blasts), but the underlying obligations are surprisingly consistent: identify the sender, identify the company, and give the recipient a way to reach you. Here is what the major jurisdictions actually require, with no legalese.

A disclaimer first: this is not legal advice

Nothing in this article is legal advice and we are not lawyers. The information here is a summary of widely published regulatory guidance as of 2026 and should be treated as a starting point for a conversation with your own counsel. Jurisdictions update their rules frequently and the consequences of getting compliance wrong range from inconvenient (a stern letter) to substantial (six-figure fines for systematic GDPR breaches).

That said, the basics below cover roughly 90% of what a small business or freelancer in the major Western economies needs to know to be sensible.

United Kingdom: the Companies Act and PECR

The UK Companies Act 2006 requires every limited company to state, on every form of business email correspondence, four pieces of information: the registered company name, the company registration number, the place of registration (e.g. "Registered in England and Wales"), and the registered office address. This applies whether the email is a one-line reply or a formal proposal. It does not apply to sole traders or unincorporated partnerships.

The Privacy and Electronic Communications Regulations (PECR) layer on additional rules for marketing emails specifically: an opt-out mechanism, a clear identification of the sender, and a valid postal address. PECR rules apply only to commercial electronic communications, not to ordinary business correspondence.

Failing to include the Companies Act details in business emails can result in fines, though enforcement is rare in practice. The bigger risk is that contracts signed from a non-compliant email account can occasionally be challenged on procedural grounds.

European Union: GDPR and member-state company law

The GDPR itself does not specify what an email signature must contain, but two GDPR-adjacent obligations affect signatures heavily.

The first is the requirement to identify your data controller and provide a means of contact for privacy enquiries. Many EU companies include a short line in their signature directing recipients to their privacy policy URL, which is generally considered sufficient for routine correspondence.

The second is consent for tracking. If your email signature contains a tracking pixel, a link with UTM parameters used for analytics, or an embedded read-receipt, the recipient may need to have consented under PECR (the EU's e-Privacy rules). For ordinary one-to-one business email, this is rarely a problem; for bulk marketing, it absolutely is.

On top of GDPR, every EU member state has its own company-law equivalent of the UK Companies Act. Germany's requirements (Impressumspflicht for commercial email) are particularly strict and require company name, legal form, registered office, commercial register number, court of registration, and the name of every managing director on every business email. France, the Netherlands, Italy, and most other member states have similar but less stringent rules.

United States: CAN-SPAM and state-level rules

The federal CAN-SPAM Act of 2003 applies only to commercial electronic mail messages — emails whose primary purpose is to advertise or promote a commercial product or service. Ordinary one-to-one business correspondence is generally outside the scope.

For messages that do fall under CAN-SPAM, the law requires accurate header information, a non-deceptive subject line, identification of the message as an advertisement (this can be implicit in context), a valid physical postal address for the sender, and a clear and conspicuous opt-out mechanism that remains functional for at least 30 days after sending.

In practice, most US business signatures comply by including the company name, a physical address, and a phone number. Marketing automation platforms handle the opt-out mechanism automatically. Fines for CAN-SPAM violations can reach over $50,000 per email, though enforcement focuses on systematic spammers rather than the occasional non-compliant signature.

Individual states layer on additional rules. California's CCPA and CPRA require certain businesses to provide notice of data collection and a "Do Not Sell My Personal Information" link, though signature inclusion is rarely the primary compliance mechanism.

Confidentiality notices: legal theatre or actually useful?

You have almost certainly received emails ending with a 200-word paragraph explaining that the email is confidential, intended only for the named recipient, must be deleted if received in error, and that the company accepts no liability for transmitted viruses. These confidentiality notices are mostly legal theatre and have very limited enforceability in court.

The legal reasoning is simple: a notice appended to the end of an email cannot retroactively impose contractual obligations on a recipient who never agreed to them. If you accidentally send sensitive information to the wrong person, a disclaimer at the bottom does not unsend it or obligate the recipient to keep it confidential. The recipient generally has no obligation they did not already have under existing law.

That said, confidentiality notices serve a few useful purposes: they put the recipient on notice that the content was not intended for them, they may help a litigant argue the sender took reasonable steps to protect confidentiality, and they signal to your colleagues that this is a regulated industry. In legal, medical, and financial services they are effectively expected. In most other industries they are noise.

If you do include one, keep it short. A two-line notice is just as enforceable as a twenty-line one and does not visually overwhelm the signature.

A sensible minimum for most businesses

If you are a small business or freelancer not subject to specific regulated-industry rules, a defensibly compliant signature in most jurisdictions includes your full name, your role, your company's legal name, the company registration number and registered address (if you are incorporated), a phone number or alternative contact method, and a link to your privacy policy. Marketing emails additionally need an unsubscribe link and a postal address.

This covers UK Companies Act requirements, US CAN-SPAM physical-address requirements, GDPR transparency expectations, and most equivalent rules in other jurisdictions. It is the baseline SignatureCraft's "Professional" template category is designed to support.

Step by step

Identify your jurisdiction and entity type — A UK limited company has different obligations to a US sole proprietor to a German GmbH. Start by listing the countries you send business email from and the legal form of your business.
List the mandatory fields for each jurisdiction — Use the summary above (or your lawyer's advice) to write down what must appear in every email you send.
Build a signature that covers the strictest jurisdiction you operate in — It is easier to maintain one signature that satisfies every jurisdiction than to manage different signatures per market. Use the strictest standard as your baseline.
Add the legal block as its own SignatureCraft section — In the editor, add a Custom Text section below your contact details and paste in the legal text. Use smaller text and a muted colour so it does not visually compete with your main contact info.
Link your privacy policy explicitly — Include the full URL as a hyperlink — recipients should be able to reach the policy in one click without copy-pasting a URL.
Audit annually — Rules change. Set a calendar reminder to re-check your signature against current requirements at least once a year, and whenever you incorporate, change company name, or move office.

Tips

Keep the legal block under 60 words if possible — the longer it gets, the more recipients tune it out.
Never put legally required information into an image. Images can be blocked, and the legal requirement is generally to make the information accessible, which a blocked image is not.
If you operate internationally, default to GDPR-level transparency even where it is not strictly required — it is rarely a compliance liability and signals professionalism to EU recipients.