Summary. Electronic signatures have been legally valid across the United States for twenty-five years, yet disputes about them are increasing rather than decreasing. Validity was never the hard question. The hard questions are attribution — proving a particular person made the mark — and the handful of transactions the statutes carve out, where an electronic signature is not merely risky but ineffective. This article covers the architecture of the federal ESIGN Act and state UETA, the elements that make an electronic signature enforceable, the consumer consent process most companies implement incorrectly, the excluded categories, and the evidentiary problem of authenticating an electronic record years later. It closes with implementation guidance, including notarization, transferable records, and the practices that make a record hold up.

A company sues a former employee to enforce an arbitration agreement. It produces a signed document. The signature is a cursive-font rendering of the employee's name, applied through an HR portal in 2019.

The employee says: I never signed that.

The company's motion to compel arbitration now depends on facts nobody thought about in 2019. Who had credentials to that portal? Was the password unique to this employee, or was it a default the HR administrator set? Was there multi-factor authentication? What does the audit log show — IP address, timestamp, session, the sequence of pages viewed? Was the document displayed before the signature block, or was it behind a link? Did the employee receive a copy? Is there any subsequent conduct consistent with having signed?

If the answers are good, the agreement is enforced without difficulty. If the company cannot produce an audit trail because the vendor was replaced in 2022 and the data was not migrated, the company loses — and it loses on authentication, a subject the ESIGN Act does not address at all.

That is the whole practical point of this article. Legal validity is settled and easy. Proof is neither.

The two statutes

The Electronic Signatures in Global and National Commerce Act (ESIGN), 15 U.S.C. §§ 7001–7031, enacted in 2000, applies to transactions in or affecting interstate or foreign commerce.

The Uniform Electronic Transactions Act (UETA), promulgated in 1999, has been adopted in nearly every state. New York uses its own Electronic Signatures and Records Act, which reaches substantially the same result. Illinois and Washington adopted UETA relatively late after operating under their own statutes.

How they fit together. ESIGN § 7002 preempts inconsistent state law, but a state may modify, limit, or supersede ESIGN if it has enacted UETA as approved by the uniform law commissioners, or if it enacts an alternative that is technology-neutral, consistent with ESIGN, and makes specific reference to it. In practice:

  • In a state with a clean UETA adoption, UETA governs and ESIGN recedes.
  • Where a state's UETA contains non-uniform variations, ESIGN may preempt those variations.
  • ESIGN's consumer consent provisions in § 7001(c) are not displaced by UETA in most analyses, because UETA has no equivalent. Treat those requirements as always applicable to consumer transactions.

The core rule

Both statutes say the same thing in slightly different words. ESIGN § 7001(a): a signature, contract, or other record relating to a transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form, and a contract may not be denied effect solely because an electronic signature or record was used in its formation.

Three things to understand about that rule:

1. It is a rule of non-discrimination, not of validation. The statutes do not make an electronic signature enforceable. They remove electronic form as a ground for invalidity. Everything else about contract formation — offer, acceptance, consideration, capacity, authority, mutual assent, absence of fraud — applies unchanged. A defense that would defeat a paper contract defeats an electronic one.

2. They are technology-neutral. No particular technology, encryption standard, or certificate authority is required. A typed name, a click on a button, a stylus scrawl, a scanned image of a handwritten signature, an email sign-off, and a cryptographic digital signature are all capable of being electronic signatures. The statutes deliberately declined to pick winners.

3. They require an agreement to transact electronically. UETA § 5(b): the Act applies only to transactions between parties each of which has agreed to conduct transactions by electronic means, determined from the context and surrounding circumstances, including the parties' conduct. Consent may be implied — a person who signs electronically has generally agreed — but a party may refuse to conduct a particular transaction electronically, and may withdraw agreement going forward.

What is an electronic signature

UETA § 2(8) and ESIGN § 7006(5) define it as an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record.

Break that into elements, because each is separately litigated.

"Electronic sound, symbol, or process." Extremely broad. Includes a typed name, initials, a checkbox, a click, a biometric, a PIN, a drawn signature, and a cryptographic operation.

"Attached to or logically associated with a record." The signature must be connected to the specific record. A click on a page containing a link to terms is weaker than a click on a page displaying them; a signature applied to a document whose hash is recorded in the audit trail is strongest, because the association is provable and tamper-evident.

"Executed or adopted by a person." Attribution. The hard part.

"With the intent to sign the record." The signer must have intended the act as a signature. This is where an email signature block usually fails: the automatic appending of a name to every message does not evidence an intent to sign any particular one. Courts have gone both ways on whether a typed name at the end of an email satisfies a statute of frauds, and the analysis turns on whether the sender intended it as a signature of that document.

Practical design consequence: the interface should make the signing act unmistakably a signing act — a discrete button labeled "Sign," presented after the document, with an on-screen statement that clicking constitutes a signature and creates a legally binding agreement.

Attribution: the real battleground

UETA § 9: an electronic record or signature is attributable to a person if it was the act of the person, which "may be shown in any manner, including a showing of the efficacy of any security procedure applied."

There is no presumption of attribution. That surprises people. The statute supplies a rule of evidence, not a burden shift. If the purported signer denies signing, the proponent must prove the act was theirs.

How courts evaluate it. Ruiz v. Moss Bros. Auto Group, Inc., 232 Cal. App. 4th 836 (2014), is the case that changed employer practice. An employee denied electronically signing an arbitration agreement. The employer's declaration said only that the agreement "was signed by" the employee on a specified date. The court held that this was a conclusory assertion, not evidence: the declarant did not explain how the electronic signature was created, what security procedures applied, whether the login credentials were unique to the employee, or what the audit trail showed. The motion to compel arbitration failed.

Subsequent cases have accepted employer declarations that supply exactly what Ruiz found missing — a description of the onboarding process, the unique credentials, the required password change, the inability of anyone else to access the account, and the system-generated audit record. The lesson is that the declaration must describe the system, not assert the conclusion.

What a defensible attribution record contains:

  • Unique credentials issued to the individual, with a forced password change on first use.
  • Multi-factor authentication, ideally, or at minimum a second identifying factor such as a one-time code to a personal email or mobile number on file.
  • An audit trail capturing: the signer's identifier, timestamps for each event (viewed, opened, signed, completed), IP address, browser and device fingerprint, the sequence of documents presented, and a hash of the signed document.
  • A tamper-evident seal applied at completion, so any later alteration is detectable.
  • A completion certificate generated by the platform and stored with the document.
  • Delivery of a copy to the signer, with evidence of delivery.
  • Corroborating conduct — the person subsequently used the benefits, referenced the agreement, or performed under it.

Do not overlook the human process. In-person kiosk signing where an HR administrator logs in "to help" destroys attribution entirely, and it is extremely common.

Consumer transactions: ESIGN § 7001(c)

Where a statute requires that information be provided to a consumer in writing, electronic delivery satisfies the requirement only if the consumer affirmatively consents and a specific disclosure process is followed. This is the part of the statute most often implemented incorrectly.

The required disclosures, before consent:

  1. A statement of any right or option to have the record provided on paper, and the right to withdraw consent, including any conditions, consequences, or fees.
  2. Whether the consent applies only to the particular transaction or to categories of records in the relationship.
  3. The procedures to withdraw consent and to update contact information.
  4. How the consumer may obtain a paper copy and whether a fee will be charged.

The hardware and software requirement. Before consenting, the consumer must be provided a statement of the hardware and software requirements for access and retention. And critically, the consumer must consent electronically, or confirm consent electronically, in a manner that reasonably demonstrates that the consumer can access information in the electronic form that will be used.

"Reasonably demonstrates" is the operative phrase. A consumer who consents by checking a box on a web page has demonstrated the ability to view a web page — not the ability to open a PDF, if PDFs are how the records will be delivered. The compliant design presents the consent in the same format that will be used for delivery: display a sample PDF and require the consumer to confirm they can read it, or deliver a code inside the document format and require its entry.

If requirements change after consent in a way that creates a material risk the consumer cannot access records, the provider must notify and obtain renewed consent.

The consequence of non-compliance is not that the contract is void. ESIGN § 7001(c)(3) says failure to obtain consent in the required manner does not itself invalidate the contract. But the statutory disclosure obligation is not satisfied, which can mean the disclosure was never legally made — with whatever consequences the underlying statute imposes, including rescission rights, penalties, and tolling of limitations periods. In consumer lending, insurance, and telecommunications, those consequences are substantial.

What cannot be signed electronically

ESIGN § 7003 and UETA § 3 exclude categories where an electronic record or signature does not satisfy the legal requirement.

Excluded entirely:

  • Wills, codicils, and testamentary trusts. A growing minority of states have enacted the Uniform Electronic Wills Act or similar legislation permitting electronic wills with specific safeguards. Absent such a statute, an electronically signed will is invalid. This is the single most dangerous exclusion, because estate planning documents are frequently prepared with the same software used for everything else.
  • Adoption, divorce, and other matters of family law.
  • The Uniform Commercial Code, other than § 1-107 and § 1-206 and Articles 2 and 2A. So sales of goods and leases of goods are covered; Article 3 negotiable instruments, Article 4 bank deposits, Article 5 letters of credit, Article 7 documents of title, and Article 9 security agreements are excluded from ESIGN — but most states' UCC provisions and their UETA adoption interact so that electronic authentication is permitted under the UCC's own definitions. Article 9 in particular uses "authenticate," which expressly includes electronic signing.

Excluded from electronic delivery, though the underlying contract may be electronic:

  • Court orders, notices, and official documents, and pleadings — governed instead by court rules, which now generally mandate electronic filing.
  • Notices of cancellation or termination of utility services.
  • Notices of default, acceleration, repossession, foreclosure, eviction, or the right to cure under a credit agreement secured by, or a rental agreement for, a primary residence.
  • Notices of cancellation or termination of health insurance or benefits or life insurance (excluding annuities).
  • Product recall notices and notices of material failure affecting health or safety.
  • Documents required to accompany the transportation of hazardous materials.

Practical instruction: maintain a written list of document types that must be executed or delivered on paper, and build it into the document management system so that the e-signature workflow cannot be applied to them.

Notarization and witnessing

ESIGN § 7001(g) and UETA § 11 permit electronic notarization: if a law requires a signature or record to be notarized, acknowledged, verified, or made under oath, that requirement is satisfied if the electronic signature of the notary, together with all other required information, is attached to or logically associated with the record. The notary's traditional obligations remain, including personal appearance under most state laws.

Remote online notarization (RON) removes the physical-appearance requirement, permitting notarization over audio-video communication with credential analysis and identity proofing. Nearly every state now permits RON in some form, though the requirements differ:

  • Identity proofing through knowledge-based authentication and credential analysis.
  • Audio-video recording retained for a statutory period, often five to ten years.
  • Tamper-evident technology and an electronic journal.
  • Notary commission endorsement or separate registration for RON.
  • Approved technology providers in some states.

Federal legislation to require interstate recognition of RON has been introduced repeatedly and has not been enacted, so recognition across state lines rests on each state's own recognition provisions, most of which do recognize out-of-state RON performed under the notary's home-state law. For real estate, confirm the title insurer's requirements and the county recorder's acceptance of electronic recording before planning a remote closing; both are frequently more restrictive than the statute.

Witnessing. Some documents require witnesses — deeds in a handful of states, wills nearly everywhere, and certain healthcare directives. Remote witnessing statutes exist in some states, often enacted temporarily during 2020 and made permanent unevenly. Verify before relying.

Transferable records

A paper promissory note is valuable partly because possession of the original matters. An electronic file can be copied perfectly, which destroys that property — so the statutes created a substitute.

UETA § 16 and ESIGN § 7021 define a transferable record as an electronic record that would be a note under UCC Article 3 or a document under Article 7 if it were in writing, where the issuer has expressly agreed it is a transferable record.

A person has control of a transferable record if a system reliably establishes that person as the one to which the record was issued or transferred. The safe-harbor test requires that a single authoritative copy exist that is unique, identifiable, and unalterable; that the authoritative copy identify the person asserting control; that it be maintained by that person or a designated custodian; that copies and revisions be readily identifiable as such; and that any addition or change to the record be readily identifiable as authorized or unauthorized.

A person with control has the rights of a holder under Article 3, including holder-in-due-course status if the other elements are met.

Where this matters in practice: the mortgage industry's electronic notes (eNotes) registered with the MERS eRegistry, equipment leases, and increasingly commercial notes. The scope is narrow — it does not cover chattel paper generally (Article 9 handles that through its own "control" provisions in § 9-105), and it does not cover deeds. And critically, the statutory scheme requires that the note itself state it is a transferable record; a conventional promissory note signed electronically is not a transferable record and cannot be negotiated by transfer of control.

Authenticating an electronic record in court

Validity is one problem; admissibility is another, and it arrives years later when the vendor has changed.

Federal Rule of Evidence 901(b)(9) permits authentication by evidence describing a process or system and showing that it produces an accurate result — the natural fit for e-signature platforms.

Rule 902(13) makes a record generated by an electronic process or system self-authenticating if certified by a qualified person, and Rule 902(14) does the same for data copied from an electronic device and authenticated by hash value. Both require written notice to the adverse party and an opportunity to challenge, so the certification must be obtained in time.

Practical steps to preserve admissibility:

  • Export and retain the audit trail and completion certificate with the executed document, not only inside the vendor's platform. A signed PDF without its audit trail is much weaker evidence.
  • Record the document hash at execution.
  • Plan for vendor transitions. Migrate historical records and their metadata, or export them in a self-contained form, before terminating a platform. The most common evidentiary failure in this area is a company that switched vendors and kept only the PDFs.
  • Identify a qualified certifying witness in advance — usually the platform's records custodian or the company's system administrator — and confirm the vendor will provide a Rule 902(13) certification. Many will, for a fee, and many contracts are silent on the obligation.
  • Keep the version of the document that was displayed, not merely the current template. Where terms changed over time, being able to show what this signer saw is essential.

Record retention

UETA § 12 and ESIGN § 7001(d) permit electronic records to satisfy retention requirements if the record accurately reflects the information and remains accessible to all persons entitled to access, in a form capable of being accurately reproduced for later reference.

What that requires operationally:

  • Format durability. A proprietary format readable only by discontinued software does not remain accessible. Prefer PDF/A or another archival format.
  • Integrity controls demonstrating the record has not changed.
  • Indexing sufficient to retrieve the record on demand.
  • Retention periods matching the underlying legal requirement, which for many contracts is the limitations period plus a margin, and for regulated records is set by regulation.
  • Legal hold capability that suspends destruction on litigation.

Regulated industries add requirements. 21 C.F.R. Part 11 governs electronic records and signatures in FDA-regulated contexts, requiring validated systems, audit trails that record operator entries and actions with dates and times, authority checks, and — for open systems — additional controls. Financial services rules impose their own retention and supervision requirements. Government contractors, healthcare providers, and broker-dealers each face sector-specific rules that ESIGN does not displace.

Implementation guidance

Choosing a signing method by risk tier. Not every document needs the same rigor.

  • Low risk — internal approvals, routine acknowledgments, low-value orders. Click-to-accept with a system log is fine.
  • Medium risk — commercial contracts, NDAs, employment documents, vendor terms. A commercial e-signature platform with unique authentication, an audit trail, tamper-evidence, and a completion certificate.
  • High risk — significant transactions, documents likely to be litigated, arbitration agreements, guaranties, releases. Add identity verification (government ID capture or knowledge-based authentication), multi-factor authentication, and delivery of an executed copy with confirmation. Consider a digital signature backed by a certificate.
  • Excluded or high-formality — wills, deeds in some states, documents requiring witnesses or notarization, negotiable instruments. Paper, or a compliant RON or electronic wills process where available.

Digital signatures versus electronic signatures. A digital signature uses public key cryptography: the signer's private key produces a value that anyone can verify with the public key, and any alteration invalidates it. It provides strong integrity and, where a trusted certificate authority verified identity, strong attribution. It is a subset of electronic signatures, not a legal requirement, and its main practical use in the United States is in regulated, government, and cross-border contexts. In the European Union, by contrast, the eIDAS Regulation creates tiers — simple, advanced, and qualified electronic signatures — and only a qualified signature carries the legal equivalence of a handwritten signature across member states. A U.S. company signing with EU counterparties should confirm which tier the transaction requires, because a DocuSign-style signature is generally an "advanced" signature at best.

Policy and governance. A functioning e-signature program has:

  • An approved platform list and a prohibition on ad hoc tools.
  • A document classification mapping types to required signing methods.
  • The excluded-document list, enforced technically.
  • Signature authority rules — who may bind the company for what, integrated with the platform's sending permissions.
  • Onboarding controls ensuring unique credentials and no shared logins.
  • Retention and export procedures, including vendor transition.
  • Training for the people who send documents, who are usually not lawyers.

Cross-border. Most developed jurisdictions recognize electronic signatures, but the regimes differ. The UNCITRAL Model Law on Electronic Signatures and the UN Convention on the Use of Electronic Communications in International Contracts supply the international framework. Several jurisdictions maintain formality requirements for particular documents — real property transfers, powers of attorney, corporate resolutions in some civil law countries, and employment documents in a few. Check the local requirement for any document that must be filed, registered, or presented to an authority.

Common failures

A short list of what actually goes wrong, drawn from disputes rather than from theory:

  1. Shared credentials. An administrator signs on behalf of employees "to speed onboarding." Attribution is destroyed for every document signed that way.
  2. No audit trail retained. The PDF was saved; the certificate was not.
  3. Vendor migration without export. Ten years of executed agreements now exist only as flat files with no provenance.
  4. Consumer consent by checkbox with no reasonable demonstration of the ability to access the delivery format.
  5. An electronically signed will or trust amendment in a state that does not permit it.
  6. A promissory note signed electronically and then sold, with the buyer discovering it is not a transferable record and cannot be enforced as a negotiable instrument by transfer of control.
  7. Terms behind a link rather than displayed, weakening the "logically associated" element and the assent showing.
  8. No copy delivered to the signer, which undercuts both notice and any later argument about ratification.
  9. Signature applied by an unauthorized person who had legitimate platform access — a signature authority failure that the platform will faithfully record.
  10. A "wet signature required" clause in the parties' own agreement, ignored by the operations team. The statutes permit parties to require paper, and courts enforce that choice.

A closing perspective

The statutory framework here is quietly one of the most successful pieces of commercial law reform in modern American history. In 2000 there was genuine uncertainty about whether an electronic contract was enforceable; today that question does not arise, and the volume of commerce that depends on the answer is enormous.

But the framework did exactly one thing: it removed a formal objection. It did not, and could not, solve the problem of proving who did what. A handwritten signature carries embedded evidence — the physical characteristics of the writing, the medium, the ink, the ability of an examiner to compare exemplars. An electronic signature carries none of that. Everything the proponent will ever have is the record the system created at the moment of signing, and that record either exists in usable form years later or it does not.

Which means the practical work in this area is not legal at all. It is systems design, credential management, audit logging, and records retention. The company that gets those right will never think about ESIGN. The company that gets them wrong will read § 7001 very carefully, in a brief, while losing.

Errors, changes, and repudiation

UETA § 10 addresses what happens when an electronic record is garbled or a keystroke error occurs, and it is the least-known provision in the Act.

Where a security procedure was agreed to detect changes or errors and one party conformed to it while the other did not, the conforming party may avoid the effect of the changed or erroneous record if the non-conforming party's failure to use the procedure would have detected the problem.

Individual errors in automated transactions. Where a person deals with an electronic agent — an automated system that operates without human review — and makes an error, the individual may avoid the effect of the erroneous record if the system did not provide an opportunity to prevent or correct the error, and the individual promptly notifies the other party, does not use or receive any benefit from the consideration, and returns or destroys anything received.

The design consequence is concrete: a confirmation screen that displays what the user entered and permits correction before submission eliminates this avoidance right. That single interface element is worth more than most contract language, and building it is cheap.

Repudiation and contract-level protections. Neither statute changes the rules on mistake, fraud, duress, or unconscionability. What electronic execution changes is the evidence available to prove them. A signer claiming they were rushed, that the document was misrepresented, or that they never saw a term will be met with an audit trail showing how long each page was displayed and in what order — which cuts both ways. A trail showing a fourteen-page agreement was open for nine seconds is not helpful to the party seeking enforcement.

Signature authority, and the problem the platform cannot solve

Every e-signature platform faithfully records who clicked. None of them knows whether that person had authority to bind the company.

The recurring scenario: a project manager receives a change order, signs it in the portal because that is how everything else gets signed, and commits the company to $400,000 of additional work. The signature is valid, attribution is airtight, and the company's internal policy limiting the manager's authority to $50,000 is irrelevant to a counterparty with no notice of it.

Apparent authority does the damage. A company that routinely lets operational staff sign through a platform has held them out as authorized, and the counterparty is entitled to rely. The protections are administrative rather than legal:

  • Configure the platform so that only authorized senders can initiate signature requests, and only designated signers appear as options for each document type.
  • Map signature authority to document type and dollar threshold, in a policy that exists in writing and is enforced in the tool rather than in a memo.
  • Require counter-signature above defined thresholds.
  • Give notice of authority limits to significant counterparties in the master agreement, which converts an apparent-authority problem into an actual-notice problem.
  • Audit periodically. Pull a report of everything signed in the last quarter, by whom, and confirm each was within authority. This takes an hour and regularly finds something.

Government filings and the paper that remains

A separate track of requirements governs documents submitted to public bodies, and ESIGN expressly leaves it alone: 15 U.S.C. § 7004 preserves each agency's authority to specify performance standards and formats for records it receives, so long as the requirements are not inconsistent with the Act and do not impose unreasonable costs.

What that means day to day:

  • Secretary of State filings. Nearly every state accepts electronic formation, amendment, and annual report filings, typically with a portal-based authentication rather than an e-signature in the UETA sense. A few still require paper for specific filings — certain conversions, mergers with foreign entities, and reinstatements.
  • County recorders. Electronic recording (eRecording) is available in most, but not all, counties, and coverage is uneven within a single state. For any transaction closing on a deadline, confirm the specific county's capability and its formatting requirements before the closing date.
  • Courts. Electronic filing is mandatory in nearly all federal courts and most state courts, with the filer's login serving as the signature under the local rules. Note that a filing signature is a different creature from a document signature: a declaration executed under 28 U.S.C. § 1746 still requires the declarant's own signature, and courts have rejected declarations bearing counsel's electronic filing signature instead.
  • Tax authorities. The IRS permits electronic signatures on a defined list of forms, which has expanded substantially but remains a list rather than a general rule. State revenue departments vary.
  • Immigration and employment eligibility. Form I-9 may be completed and signed electronically subject to specific integrity, retention, and audit-trail requirements, and a system that does not meet them produces a technical violation on audit even where the underlying verification was proper.

The practical instruction is unromantic: for anything that will be filed with a government body, verify the accepted format before you build the workflow. The general rule of validity does not tell you whether a particular clerk's office will accept the file.

Primary authority

Two statutes carry almost all of the weight here, and they are deliberately close to identical.

  • 15 U.S.C. §§ 7001–7031 (E-SIGN) — the federal validity rule in § 7001(a), the consumer consent requirements in § 7001(c), the record-retention and accuracy rules in § 7001(d), and the exclusions in § 7003 for wills, family law, most UCC articles, court documents, and certain notices such as utility termination, foreclosure, and health insurance cancellation.
  • 15 U.S.C. § 7002 — the preemption architecture, which lets a state UETA displace E-SIGN but forbids a state from imposing a technology preference.
  • Uniform Electronic Transactions Act (1999) §§ 5, 7, 9, 11, 12, 14, 16 — agreement to conduct business electronically, legal effect, attribution, notarization, retention, automated transactions, and transferable records. Adopted in 49 states, with New York enacting its own Electronic Signatures and Records Act instead.
  • UCC § 9-105 — control of electronic chattel paper, the provision that makes an authoritative copy of an e-note financeable.
  • 21 C.F.R. Part 11 — FDA electronic records and signatures, the separate and much stricter regime for regulated life sciences records.
  • Fed. R. Evid. 901(b)(9) — authenticating a process or system, the practical route for admitting an audit trail.
  • Fed. R. Evid. 902(13) and § 902(14) — self-authentication of records generated by an electronic process and of data copied from a device, both of which reduce the cost of proving an e-signature at trial.
  • Fed. R. Evid. 803(6) — the business records exception applied to the platform's own logs.

Related articles

This article is provided for general informational purposes and does not constitute legal advice. State adoptions of UETA vary, remote notarization and electronic wills statutes differ substantially, and sector-specific regulations impose additional requirements. Consult qualified counsel before implementing an electronic signature program or relying on an electronically executed document in an excluded category.