Posted on 30 July 2026

GDPR and Email Signatures: What You Need to Know

Email signatures rarely make anyone’s GDPR checklist — but they should. Some signature tools quietly embed tracking that processes personal data without consent, and that’s exactly the kind of thing GDPR exists to govern. Here’s what to watch for.

General guidance, not legal advice — check with your DPO or solicitor for your specific obligations.

The hidden problem: tracking pixels

Many signature-management platforms insert a tiny invisible image — a tracking pixel — into every email. It reports back when and where the recipient opened your message, their approximate location and device. Under GDPR, that’s processing personal data, typically without the recipient’s knowledge or consent. It’s a genuine compliance risk, and most senders have no idea it’s happening.

What GDPR-friendly looks like

• No tracking pixels monitoring the people you email.
• Hosted images that don’t profile the recipient — an image should just be an image.
• Only the personal data you need in the signature itself (a work name and number is fine and expected).
• Transparency about any data you do collect.

Personal data in the signature

Your own contact details in a signature are low-risk — that’s normal business communication. The risk is in covert processing of the recipient’s data, which is where tracking crosses the line.

The privacy-first approach

Mirosign is deliberately built without tracking — your signature does its job (looking professional) without quietly surveilling everyone you email. It’s better for compliance and, frankly, better ethics.

Learn more about no-tracking signatures, or build a privacy-first signature free →