Email Signature Laws by Country: GDPR, CAN-SPAM and the 2026 Rules
What you legally must and must not include in a business email signature — and why enforcement changed in 2024.
By Editorial Team, Editors, SignatureCraft · Updated 2026-07-01 · 11 min
A working guide to what belongs in a business email signature under EU, UK, US, Australian, Canadian and UAE law — with the practical mistakes we still see companies make in 2026.
Why the signature is a legal document, not decoration
An email signature looks like a design element. Legally, in most of the developed world, it is closer to a business card, a letterhead, and a company registration certificate stapled together. When you send an email as an employee of a company, courts in the EU, UK, Australia, Canada and — increasingly — the US treat the signature block as part of the outgoing business communication, subject to the same disclosure rules as a printed invoice or a shopfront sign.
That is not a theoretical position. In 2004 the UK Companies Act was extended to explicitly cover email; in 2007 Ireland followed; Germany has treated the signature as an extension of the Impressum requirement since the mid-2000s; and both France (article R123-237 of the Code de commerce) and the Netherlands have brought enforcement actions against firms whose emails did not disclose the registered company name and number. The fines are usually small — a few hundred to a few thousand euros — but they are real, and they scale badly when a regulator finds thousands of non-compliant emails during an unrelated audit.
What changed in the last three years is enforcement discipline. Regulators used to treat signature-block compliance as a 'we will write to you first' issue. After the 2023 uptick in phishing-related company impersonation, several EU data protection authorities (notably the Irish DPC and the French CNIL) started treating missing company identification as a contributing factor when investigating fraud complaints. The signature has become, quietly, part of the anti-fraud perimeter.
European Union: what must be there
The baseline across the EU comes from two places: the E-Commerce Directive (2000/31/EC), which sets minimum information requirements for commercial communications, and each member state's company law. Together they produce a fairly consistent set of required fields for any email sent on behalf of a registered company.
You need the legal name of the company (not just the trading name), the legal form (GmbH, SARL, Ltd, B.V., etc.), the registered office address, the company registration number, and — if the company is VAT-registered — the VAT identification number. For regulated professions (lawyers, doctors, financial advisors, real-estate agents), you additionally need the supervisory authority and, in Germany, the professional title and the state in which it was awarded.
Missing pieces we see constantly: no company registration number, an office address that is actually a coworking space with no legal relationship to the company, a trading name in the signature but no legal name anywhere in the email, and — under GDPR — no link to a privacy notice when the email is a marketing communication. The last one is the most commonly overlooked. If you send commercial email into the EU and the signature does not either link to a privacy notice or the email itself does, you have a GDPR Article 13 problem, not just an aesthetics problem.
United Kingdom: post-Brexit and the Companies Act
The UK's rules survived Brexit almost unchanged. Under sections 82–85 of the Companies Act 2006, every business email sent by a UK-registered limited company must include the registered company name, company number, place of registration (typically 'Registered in England and Wales') and the address of the registered office. Failing to include these is a strict liability offence, punishable by a fine of up to £1,000 plus £100 per day of continued non-compliance.
In practice, Companies House does not send inspectors reading your emails. But if you end up in a commercial dispute, the other side's solicitor will absolutely raise the missing signature block as either a bargaining chip or a costs argument. We have watched a small UK agency lose a costs order in 2022 partly because their emails omitted the company number — the judge treated it as evidence of general non-compliance with statutory duties.
A separate 2024 update: the Economic Crime and Corporate Transparency Act tightened the definition of what counts as a 'registered office'. A PO box or a residential address you do not actually work from is no longer sufficient. Your signature address should match the address Companies House has on file, and that address must be somewhere the company actually receives post.
United States: CAN-SPAM and the state-level twist
US federal law is much lighter than EU law here. There is no general requirement to include company registration details in every business email. The one federal rule that touches signatures is CAN-SPAM (15 U.S.C. § 7704), and it applies specifically to commercial email — anything whose primary purpose is to advertise or promote a commercial product or service.
For CAN-SPAM messages, the signature (or elsewhere in the email) must contain a valid physical postal address of the sender and a clear, functioning unsubscribe mechanism. That is it, at the federal level. There is no requirement for a company registration number, no requirement for a legal form, and no requirement for a privacy notice.
Where it gets interesting is the state layer. California's CCPA/CPRA effectively pushes companies who serve California residents toward including a 'Do Not Sell or Share My Personal Information' link in marketing communications. Colorado, Connecticut and Virginia have similar downstream expectations. And several states (notably New York for financial services, and Illinois for biometric data handlers) impose sector-specific disclosure duties that most companies satisfy by adding a compact regulatory footer beneath the signature.
Australia, Canada, and the Middle East
Australia's Corporations Act 2001 (section 153) requires the company's ACN or ABN to appear on all public documents including electronic communications. It is a small addition — usually one line — but it is genuinely mandatory for Pty Ltd companies, and the ASIC has issued fines for repeat non-compliance.
Canada layers CASL (the Canadian Anti-Spam Legislation) on top of common-law disclosure duties. CASL requires commercial electronic messages to identify the sender by legal name, provide a valid mailing address, and offer an unsubscribe mechanism — very similar to CAN-SPAM but enforced more assertively. The CRTC has issued multi-million-dollar penalties for CASL breaches, and inadequate signature blocks have been cited as evidence in several of those cases.
The UAE and Saudi Arabia both moved in 2023 toward tighter e-commerce disclosure rules. In the UAE, Federal Decree-Law No. 14 of 2023 on Trading by Modern Technological Means effectively requires trade licence numbers and physical addresses in commercial correspondence. Saudi Arabia's e-commerce regulations expect a commercial registration number and — for VAT-registered entities — the VAT number.
The practical signature block that clears every jurisdiction
If you send email internationally and want a single signature that satisfies the widest possible set of rules without turning into a legal notice, this is the pattern we recommend to clients. Keep the human block — name, title, phone — at the top. Below it, a compact company block: legal name, legal form, address, registration number, VAT number if applicable. Below that, a small-print line with the confidentiality/privacy notice link and, for regulated industries, the supervisory authority.
For companies that send both transactional and marketing email, we recommend two signature variants: a full compliance signature for anything that could be classified as commercial, and a trimmed personal-communication signature for one-to-one exchanges. The full signature carries the unsubscribe link, the marketing disclaimer, and any regulator-specific text. The trimmed signature keeps only the identification information required by company law.
The final thing to remember: legally, the signature has to be readable. A pale grey 8-point disclaimer that no one can actually read is, in several EU jurisdictions, treated as absent. If you are going to include the required text, include it at a size and contrast a reasonable person would notice.
What this means for how you build signatures in 2026
The three shifts to plan for over the next year. First, regulators are increasingly cross-referencing signature information against public registries when investigating fraud, so getting the registered address wrong now has a higher blast radius than it used to. Second, the EU's Digital Services Act enforcement is starting to touch B2B communications where influencer-adjacent behaviour appears, so if your emails promote paid partnerships, expect a disclosure obligation in the signature. Third, accessibility — long a 'nice to have' for signatures — is becoming a compliance question in its own right under the European Accessibility Act as of June 2025.
None of this is exotic. It just means treating the signature the way you treat your website footer: as a legal artefact, kept up to date deliberately, reviewed once a year, and versioned across the company rather than left to each employee's taste.
Put these tips into practice
The SignatureCraft editorial team writes about email tooling, deliverability and the small design details that quietly shape how professional we look online.