CCPA and Email Signatures

The California Consumer Privacy Act, as amended by the CPRA, contains no requirement to put particular wording in an email signature. Where it becomes relevant is the tracking layer that modern signature platforms add. Open-tracking pixels and click-tracked links in a signature collect information tied to an identifiable person, which brings that collection inside the definition of personal information. That creates two practical obligations for California-facing businesses. The collection needs to be disclosed in the privacy notice that the business already maintains, in enough detail that a reader understands email interaction is being measured. And where that data is shared with a third party in a way that meets the statutory definition of a sale or share, the opt-out right applies. The pragmatic response is not to abandon signature analytics but to name it in the privacy policy alongside other web and email tracking, link the privacy policy from the signature itself, and be able to disable tracking for specific groups or regions. Businesses that operate across California and the EU usually find that meeting the stricter GDPR position covers the CCPA position as well.