Consent and disclosures in consumer e-signature transactions
Most e-signature compliance failures are not about signatures. They are about consent. Businesses configure a platform, send a document, collect a signature, and never capture the disclosure that ESIGN requires for consumer transactions — then discover the gap during a dispute or an audit, when it is far too late to reconstruct.
Why consent is a separate requirement
The ESIGN Act's premise is that people should not lose access to important written information simply because a business chose to go paperless. So for consumer transactions involving legally required written notices, the statute adds a gate: the consumer must affirmatively consent, and the business must first tell them what they are consenting to.
The gate exists because the alternative — a business unilaterally moving time-sensitive notices into an electronic channel the consumer cannot access — would be a trap. The disclosure requirement is the consumer's protection against that.
What the disclosure must contain
A compliant disclosure tells the consumer, clearly and conspicuously:
- That they have the right to have the record provided on paper, and how to exercise that right
- Whether their consent applies to a single transaction or to a category of transactions
- That they may withdraw consent, and how
- The consequences of withdrawing — including the possibility that the transaction cannot be completed electronically
- The hardware and software requirements for accessing and retaining the electronic records
- How to obtain a paper copy, and whether a fee applies
The hardware and software statement is the item most often missing. It cannot be generic. It must describe what is actually needed — a current browser, a PDF reader, a working email address, and enough storage or printing capability to retain the record.
How consent must be captured
The statute requires that the consumer consent electronically in a way that reasonably demonstrates they can access the information. In practice, that means the consent action must be a deliberate step, not a pre-checked box, and it should be capable of being tied back to the specific disclosure shown at that moment.
Two design rules follow:
- Do not pre-check consent. A pre-checked box is not consent in any meaningful sense and will not read well if challenged.
- Show the disclosure, do not link to it. A link to your current terms does not prove what the consumer saw. Render the disclosure in the flow and log the version presented.
The evidence you should be keeping
| Item | Why it matters |
|---|---|
| Exact disclosure text and version identifier | Proves what was shown, not what exists now |
| Timestamp of disclosure presentation | Establishes sequence |
| The consent action itself | Demonstrates affirmative, non-pre-checked consent |
| Authentication method used | Ties the consent to a person |
| How to withdraw, as communicated | The disclosure obligation is ongoing |
| Paper-copy request path and any requests received | Demonstrates the right was honoured |
Withdrawal has to actually work
Consent to electronic delivery is not irreversible. A consumer can withdraw, and when they do, your process must switch them back to paper for the affected records. A "withdraw consent" link that opens a contact form nobody monitors is a compliance liability, not a feature.
Business-to-business is different, but not exempt from sense
B2B transactions generally do not require the ESIGN consumer disclosure. Consent is usually inferred from the parties' conduct — they exchanged documents electronically and proceeded. But the underlying logic still applies: if a counterparty later claims they never agreed to electronic delivery, the evidence that resolves it is the same evidence you would keep for a consumer transaction.
Not legal advice. Disclosure content requirements depend on the transaction and the jurisdiction. Have counsel review your actual disclosure language.
Related: the ESIGN Act · audit trails · privacy policy