What a cold email signature legally needs to include

Two different questions about a signature

How a signature looks is a design decision. What a signature — or the message around it — has to include to be legally compliant for commercial email is not optional, and it doesn't depend on how minimal or branded the design is. This covers the second question. This is not legal advice; for your specific situation, especially outside the US, consult counsel.

CAN-SPAM's concrete requirements

For commercial email sent to US recipients, CAN-SPAM requires: a subject line that isn't deceptive about the message's content, clear identification that the message is an advertisement if it is one, a valid physical postal address for the sender, and a working opt-out mechanism that's honored within 10 business days of the request. The postal address doesn't have to be in the signature specifically, but it has to be somewhere in the message that the recipient can actually see — not hidden behind a "View entire message" clip caused by an oversized HTML template.

GDPR and the EU/EEA layer

For recipients in the EU/EEA, the legal basis for sending — typically legitimate interest for B2B outreach, with a documented balancing assessment — is a separate requirement from CAN-SPAM's disclosure rules, and some member states' national ePrivacy implementations add further restrictions on unsolicited electronic marketing. Again, this is not legal advice; the point here is that a US-compliant signature and message do not automatically satisfy EU requirements.

List-Unsubscribe headers: not optional for bulk senders anymore

Gmail and Yahoo's bulk sender requirements expect a List-Unsubscribe header with both a mailto: and an https:// option, plus List-Unsubscribe-Post: List-Unsubscribe=One-Click as defined in RFC 8058, so the mail client can offer one-click unsubscribe directly in its own interface. This is a header-level mechanism, separate from any unsubscribe link you put in the visible body or signature — add both.

What this looks like in headers

List-Unsubscribe: <mailto:unsubscribe@mailpilots.in>, <https://mailpilots.in/unsubscribe?id=123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Most sending platforms and ESPs can add these automatically per message if you configure the unsubscribe endpoint — check whether yours does, because a missing or non-functional one-click unsubscribe is now something Gmail and Yahoo specifically watch for from bulk senders.

A compliant minimal signature

— Sam Okafor
MailPilot team
mailpilots.in

123 Example St, Suite 400, Austin, TX 73301
Unsubscribe: mailpilots.in/unsubscribe

Three identity lines, a postal address, and a visible opt-out link — on top of the List-Unsubscribe headers, not instead of them.

What not to do

Do not rely only on an in-body "unsubscribe" link with no List-Unsubscribe headers — Gmail and Yahoo's bulk-sender expectations are explicit about the one-click header mechanism. Do not bury the postal address or opt-out behind content that an oversized HTML template might clip. Do not assume compliance with one jurisdiction's rules covers another's — check both if you send cross-border.

Requirements at a glance

A common failure that passes casual review

A signature that includes a postal address and an unsubscribe link looks compliant at a glance, but if that content sits below the fold in an oversized HTML template that Gmail clips around 102KB, the recipient never actually sees it without clicking "View entire message" — which most people don't. The requirement is that the information be present and reasonably accessible, not buried behind a size limit your own template design created. Keep the message small enough that clipping isn't a factor, and add the List-Unsubscribe headers regardless, since those work independently of whatever happens to the visible body.

None of this replaces reading the actual statutes and guidance

This post summarizes the practical, recurring requirements worth checking, but CAN-SPAM, GDPR, and each mailbox provider's bulk-sender policy are all primary sources worth reading directly if you're setting up a compliance process for the first time, particularly if you send across multiple jurisdictions with different rules layered on top of each other.

Keep the postal address current

A postal address that's technically present but outdated — a former office, a registered-agent address nobody checks — satisfies the letter of CAN-SPAM but undermines the purpose of the requirement, which is giving a recipient a real way to identify who's contacting them. Keep it current whenever the business address changes.

Where MailPilot fits

MailPilot checks SPF, DKIM, and DMARC on every sending domain and tracks per-mailbox reputation daily, which is the deliverability side of staying off Gmail and Yahoo's bulk-sender problem list — compliance headers and a real postal address are the other half, and both need to be right together.