Law vs. email disclaimers: overview of existing international legislation

The number of laws concerned with data protection, business accountability, and the transparent use of AI online continues to grow, with corporate email increasingly falling within their scope. In some cases, failing to meet correspondence-related requirements can result in severe penalties, but you can often reduce that risk by adding an appropriate legal disclaimer to your business emails.

But when exactly do you need a disclaimer? Contrary to reports floating around on the web, email disclaimers are rarely mentioned explicitly in legislation. So, let’s look at the extent to which laws in different regions of the world mandate the use of email disclaimers and how they determine their status.

NOTE: Information in this article does not constitute legal advice or legal opinions. You should not act or rely on it without first seeking the advice of an attorney.

US email disclaimer requirements

Health Insurance Portability and Accountability Act (HIPAA)

Applies to: Messages sent by covered entities (such as health plans or healthcare providers) and their business associates in the US.

Requirements: Implementation of appropriate administrative, technical, and physical safeguards to guarantee the confidentiality of patients’ Protected Health Information (PHI).

Email disclaimers: While HIPAA does not explicitly require healthcare companies to use email disclaimers, they are considered a supplementary measure used to discourage the unauthorized use, disclosure, or distribution of patients’ data. They are also a good method of informing patients about the privacy risks related to sending their individual health information via email.

Reference: https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html

Gramm-Leach-Bliley Act (GLBA)

Applies to: Messages sent by financial institutions in the US.

Requirements: Disclosure of information-sharing practices to customers and protection of nonpublic personal information through appropriate safeguards, such as message encryption.

Email disclaimers: They can be used in an auxiliary capacity, for example, to provide a link to relevant privacy information. They may also caution customers against sending sensitive financial data, such as account numbers, in unencrypted email messages.

Reference: https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act

California Consumer Privacy Act

Applies to: Messages sent by qualifying companies that do business in California and collect consumers’ personal information.

Requirements: Disclosure of data collection and processing practices, along with consumers’ privacy rights. Businesses that sell or share personal information must also provide a way for California consumers to opt out, for instance, through a dedicated link on the company website.

Email disclaimers: While not explicitly required, disclaimers can be a convenient way to provide links to privacy policies and opt-out mechanisms for California consumers.

Reference: https://oag.ca.gov/privacy/ccpa

SAFE Act (The Secure and Fair Enforcement for Mortgage Licensing Act of 2008)

Applies to: Communications from mortgage loan originators (MLOs) to potential consumers.

Requirements: Disclosure of unique identifiers assigned through the Nationwide Multistate Licensing System & Registry (NMLS) in initial written communication with consumers, allowing them to verify the mortgage loan originator’s registration and licensing data.

Email disclaimers: They can be used to share the relevant NMLS IDs with consumers.

Reference: https://ncua.gov/regulation-supervision/manuals-guides/federal-consumer-financial-protection-guide/compliance-management/lending-regulations/secure-and-fair-enforcement-mortgage-licensing-act-safe-act-regulation-g

California Business and Professions Code

Applies to: Advertising and solicitation messages sent by California real estate licensees.

Requirements: Disclosure of the licensee’s name, license identification number, and responsible broker’s identity in advertising materials intended to be the first point of contact with customers.

Email disclaimers: Email is among the electronic media covered by the disclosure requirements. Disclaimers can be used to provide the required details across all relevant advertising and solicitation emails.

Reference: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=10140.6

Virginia Administrative Code

Applies to: Advertising by Virginia real estate firms and affiliated licensees.

Requirements: A clear, legible, and conspicuous advertising disclosure that includes the firm’s name and office contact information.

Email disclaimers: For advertising sent by email, disclaimers can provide a convenient way to include the required firm and contact information in every relevant message.

Reference: https://law.lis.virginia.gov/admincode/title18/agency135/chapter20/section190/

Canada email disclaimer requirements

Canada’s Anti-Spam Legislation (CASL)

Applies to: Commercial electronic messages sent to recipients in Canada.

Requirements: Aside from a few exceptions, Canadian users must always be given the option to provide express and informed consent before they receive any commercial messages from a company or individual. Messages must also include clear sender identification and a readily available opt-out mechanism.

Email disclaimers: They are the best way to meet the CASL requirement for appending commercial messages with clear and up-to-date sender identification, i.e.:

• the sender’s name,
• the name of a person or organization on whose behalf the message is sent (if applies),
• the current mailing address,
• a phone number, email address, or web address, and
• an unsubscribe link or information about opt-out possibilities (requests must be fulfilled within 10 business days)

Reference: http://fightspam.gc.ca/eic/site/030.nsf/eng/00288.html

EU email disclaimer requirements

General Data Protection Regulation (GDPR)

Applies to: All messages containing personal data within the scope of the GDPR, processed by organizations established in the EU and certain organizations outside of it.

Requirements: Personal information can only be collected and processed if there is an appropriate legal basis, such as consent given by the data subject. Data subjects must also be informed in detail about:

• the identities and contact details of the data controller and their representatives (if present),
• the reason for data collection/processing,
• third parties involved in data collection/processing,
• whether the personal data is required for the provision of services, or
• means of directing claims and opting out of data collection.

Email disclaimers: Disclaimers are commonly accepted as a medium for providing a link to the company’s privacy policy and other documents containing relevant privacy information. 

Reference: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng

AI Act

Applies to: Public-interest messages generated or manipulated with AI tools, sent by organizations within the scope of the AI Act (including organizations outside the EU if the AI output is used in the EU).

Requirements: Disclosure that the text has been artificially generated or manipulated, unless reviewed or edited by a human.

Email disclaimers: In public-interest messages distributed via email, disclaimers provide a useful way to share the required AI disclosure.

Reference: https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng

European Union Directive 2017/1132

Applies to: All company letters and order forms.

Requirements: Messages must contain the legal form of the sender’s company, location of its registered office, as well as the company register and registration number. If the company is being wound up, the fact must also be stated.

Email disclaimers: They are a commonly accepted way to include the required company information in all correspondence covered by the requirements.

Reference: https://eur-lex.europa.eu/eli/dir/2017/1132/oj/eng

Below are examples of national legislation reflecting the requirements of the EU Directive 2017/1132:

Ireland

As stated in the Companies Act 2014, companies are required to include in all letters and order forms (whether in paper or electronic form):

• the company’s name and legal form,
• the place of registration and Company Registration Number (CRN), and
• the physical address of the registered office.

References: 

https://www.irishstatutebook.ie/eli/2014/act/38/section/49/enacted/en/html

https://www.irishstatutebook.ie/eli/2014/act/38/section/151/enacted/en/html#sec151

Germany

The German EHUG act (Gesetz über elektronische Handelsregister und Genossenschaftsregister) requires commercial emails, like other business letters, to disclose various company details, depending on the company’s legal form. Such details include, for instance:

• the company’s name and legal form,
• the company’s registered seat,
• the registration court and registration number,
• details of directors or board members, and
• information on capital.

Reference: https://dip.bundestag.de/vorgang/gesetz-%C3%BCber-elektronische-handelsregister-und-genossenschaftsregister-sowie-das-unternehmensregister-ehug/7635

France

Article R 123-237 of the French Commercial Code requires businesses to include the following information in corporate emails:

• the company’s unique identification number (SIREN number),
• the Register of Commerce (RCS) in which company is registered,
• the location of the registered office,
• the fact that the company is in liquidation (if applies),
• for companies with a registered office outside France, emails must also include the company’s name, legal form, and registration number in its home country,
• the fact that the company is run by a lease manager (locataire-gérant) or an authorized management agent (gérant-mandataire), if applies.

Reference: https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000023379456

UK email disclaimer requirements

Companies Act 2006

Applies to: Electronic business letters and order forms sent by UK companies.

Requirements: Businesses are required to append electronic messages with the following details:

• the company’s registered name,
• the part of the UK where the company is registered,
• the company’s registration number,
• the address of the company’s registered office,
• the fact that it is a limited company, if the company is exempt from adding the word “limited” to its name or if the company is a community interest company which is not a public company,
• the amount of paid-up share capital (if the company has chosen to state its shared capital).

Email disclaimers: They are a convenient way to include all the required information across all company emails.

Reference: https://www.legislation.gov.uk/ukpga/2006/46/contents

Australia email disclaimer requirements

Spam Act 2003

Applies to: Commercial electronic messages sent from Australia or accessed by recipients in Australia.

Requirements: Businesses are generally required to include the following information in commercial correspondence:

• the company’s name,
• accurate contact details,
• a clear and functional unsubscribe mechanism.

Email disclaimers: They are commonly accepted as a means of including the required company information, contact details, and unsubscribe links or instructions in commercial emails.

Reference: https://www.legislation.gov.au/C2004A01214/2005-07-01/text

Why use email disclaimers

As you can see, email disclaimers aren’t explicitly required by most laws – but they are commonly used by both corporate and private users to include privacy notices, corporate details, confidentiality or AI-related statements, and other important information that may be legally required.

Still, my article does not cover the full scope of international email disclaimer legislation. Countries I failed to mention may have their own unique or very similar laws in place. And judging by the growing trend of Internet regulation and increasing recognition of end users’ rights to privacy and transparency, I would guess that more disclaimer-related laws are yet to come.

If you’re still on the fence about attaching a disclaimer to your business emails, remember that, regardless of your local regulations, it can always be used as a supplementary measure to provide recipients with company details, share relevant policies, and promote good practices in email communication. And the worst-case scenario is that it will go unnoticed.

How to automatically add legal disclaimers to all company emails with CodeTwo

The easiest way to ensure that all company emails include the required legal information is to use a dedicated email signature management solution, such as CodeTwo Email Signatures 365 (for Microsoft 365 environments) or CodeTwo Email Signatures On-prem (for on-premises Microsoft Exchange Server).

With CodeTwo, you can automatically add legal disclaimers to company emails whenever and wherever they’re needed. Going beyond Microsoft’s native disclaimer features, CodeTwo lets you add disclaimers directly below each new message, reply and forward. This helps prevent duplicate disclaimers from piling up at the bottom of email conversations while ensuring that the required legal information remains visible.

In addition to legal disclaimers, CodeTwo’s email signature software allows you to centrally manage company-wide email signatures to maintain consistent branding across all business emails, keep employee information up to date, promote your marketing campaigns with clickable banners, and much more.

Choose your email platform to learn more about managing email disclaimers and signatures with CodeTwo:

• Microsoft 365 – add automatic legal disclaimers under all new messages, replies, and forwards with CodeTwo Email Signatures 365.
• Exchange Server – automate legal disclaimers, inspect and control email content, and manage attachments with CodeTwo Email Signatures On-prem.