ESIGN Consent Disclosure

Under the ESIGN Act section 101(c), consumers must consent to receiving records electronically before an electronic signature can be captured. SpitShake collects that consent from every signer, in one of two styles chosen per template:

`esign_disclosure_style`	What the signer sees
`"inline"` (default)	No pop-up. Under the final button (Complete & Submit, the quick-sign carousel’s COMPLETE, or Confirm & Sign) a line reads: By clicking “COMPLETE”, you agree to the Consent to Electronic Records & Signatures and to use electronic records and signatures. The linked title opens the full disclosure. Clicking the button is the consent.
`"modal"`	A full-screen disclosure before the form; the signer clicks I Agree & Continue (or Decline) before seeing the document.

Either way consent is recorded server-side before the signature is accepted — the submit endpoint refuses a signature without it. For B2B transactions the consent step can be removed entirely (see Disabling for B2B templates).

Inline became the default on 2026-09-23. Templates that never chose a style switched from the pop-up to the consent line; set "esign_disclosure_style": "modal" to keep the pop-up.

How it works

A signer opens their signing link (/s/:slug).
Inline: they go straight to the form (or the quick-sign carousel). The consent line sits under the final button, linking to the full disclosure — paper alternative, withdrawal rights, hardware requirements, what the consent covers. Modal: they see that disclosure first and click I Agree & Continue.
When the signer clicks the final button (inline) or I Agree & Continue (modal), consent is recorded in the submitter’s encrypted metadata: timestamp, IP address, user agent, esign_disclosure_style, and — for inline — esign_disclosure_consent_text, the exact sentence shown under the button. That sentence is composed by the server from the template, never taken from the browser.
An immutable audit entry of type esign_disclosure.accepted is written, carrying the style and (inline) the sentence.
Only then is the signature submitted.

Configuration

Template preferences

The consent modal is controlled by these template.preferences keys:

Key	Type	Default	Description
`esign_disclosure_style`	string	`"inline"`	`"inline"`: consent line under the final button. `"modal"`: pop-up before the form.
`esign_disclosure_enabled`	boolean	`true`	Collect consent at all. Set to `false` (with the acknowledgment below) only for B2B templates.
`esign_disclosure_title`	string	`"Consent to Electronic Records & Signatures"`	Disclosure title — the pop-up heading, and the linked words in the inline consent line.
`esign_disclosure_body`	string	(federal default copy)	Custom modal body. Plain text with line breaks for paragraphs. Overrides the default copy entirely.
`esign_disclosure_agree_button_text`	string	`"I Agree & Continue"`	Agree button text (pop-up style only).
`esign_disclosure_bypass_acknowledged`	boolean	`false`	Required when disabling — sender attests this template is B2B only.

Override the title, body, or button text via the API:

curl -X PUT "$SPITSHAKE_URL/api/templates/42" \
  -H "X-Auth-Token: $SPITSHAKE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "preferences": {
      "esign_disclosure_title": "Electronic Signing Agreement",
      "esign_disclosure_body": "By proceeding, you agree to sign electronically.\n\nYou may request a paper copy at any time by contacting us.",
      "esign_disclosure_agree_button_text": "Accept & Sign"
    }
  }'

The body uses plain text with \n\n for paragraph breaks (rendered with whitespace-pre-line). When a custom body is set, it replaces the default federally-compliant copy entirely. The “Full disclosure” link to /legal/esignature-disclosure is always shown regardless of custom body.

If you provide custom body text, ensure it meets ESIGN Act section 101(c) disclosure requirements. Your organization’s legal counsel should review any custom copy before use.

Disabling for B2B templates

For pure B2B transactions where both parties are businesses (not consumers), the ESIGN section 101(c) consumer consent requirement does not apply. You can disable the modal:

curl -X PUT "$SPITSHAKE_URL/api/templates/42" \
  -H "X-Auth-Token: $SPITSHAKE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "preferences": {
      "esign_disclosure_enabled": false,
      "esign_disclosure_bypass_acknowledged": true
    }
  }'

Both flags must be set. The server requires esign_disclosure_bypass_acknowledged: true alongside esign_disclosure_enabled: false — setting the disable flag alone without the acknowledgment has no effect (the modal still shows). When the modal is disabled:

The signer lands directly on the start screen or first field.
The server auto-stamps acceptance metadata with esign_disclosure_bypassed_by_template: true and esign_disclosure_bypass_reason: "template_preference".
An immutable audit entry of type esign_disclosure.bypassed_by_template is written.

Only disable for B2B / non-consumer transactions. Under the ESIGN Act, consumer signers must consent to receiving records electronically. Your organization’s legal counsel should approve disabling the disclosure.

Re-enabling

Set esign_disclosure_enabled back to true (or remove it from preferences):

curl -X PUT "$SPITSHAKE_URL/api/templates/42" \
  -H "X-Auth-Token: $SPITSHAKE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "preferences": {
      "esign_disclosure_enabled": true
    }
  }'

New submissions created after re-enabling will show the modal. Previously-bypassed submitters retain their bypass metadata (no retroactive change).

Builder UI

The consent modal can also be configured in the template Builder:

Open a template in the Builder (/templates/:id/edit).
Open the template settings panel.
Find the Electronic Signature Disclosure section.
Toggle Show ESIGN consumer consent disclosure to enable or disable.
When enabled: choose How signers give consent — A line under the sign button (default) or A pop-up before the document opens — and fill in optional custom title, body, and agree button text.
When disabled: an amber warning appears with a B2B acknowledgment checkbox that must be checked.
Changes auto-save after 3 seconds.

Audit trail

ESIGN consent events are recorded in the immutable audit trail:

Event	Description
`esign_disclosure.accepted`	Signer consented: clicked the final button under the consent line (`style: "inline"`) or “I Agree & Continue” on the pop-up (`style: "modal"`).
`esign_disclosure.bypassed_by_template`	Template had disclosure disabled; acceptance was auto-stamped server-side.

Audit entry example (inline consent, the default):

{
  "event_type": "esign_disclosure.accepted",
  "timestamp": "2026-09-23T17:15:21.000Z",
  "ip_address": "198.51.100.22",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...",
  "metadata": {
    "style": "inline",
    "consent_text": "By clicking \"COMPLETE\", you agree to the Consent to Electronic Records & Signatures and to use electronic records and signatures.",
    "disclosure_title": "Consent to Electronic Records & Signatures"
  }
}

With the pop-up style, metadata is { "style": "modal", "disclosure_title": "…" }. Submitter metadata after acceptance (inline):

{
  "esign_disclosure_accepted_at": "2026-09-23T17:15:21.000Z",
  "esign_disclosure_accepted_ip": "198.51.100.22",
  "esign_disclosure_accepted_user_agent": "Mozilla/5.0...",
  "esign_disclosure_style": "inline",
  "esign_disclosure_consent_text": "By clicking \"COMPLETE\", you agree to the Consent to Electronic Records & Signatures and to use electronic records and signatures."
}

Submitter metadata when bypassed by template:

{
  "esign_disclosure_accepted_at": "2026-04-20T14:22:00.000Z",
  "esign_disclosure_bypassed_by_template": true,
  "esign_disclosure_bypass_reason": "template_preference",
  "esign_disclosure_accepted_ip": "198.51.100.22",
  "esign_disclosure_accepted_user_agent": "Mozilla/5.0..."
}

Submission gate

The consent disclosure is enforced as a server-side gate. If a signer attempts to submit (POST /s/:slug/submit) without prior acceptance, the server returns:

{
  "error": "Electronic signature disclosure must be accepted before submitting.",
  "code": "esign_disclosure_required"
}

This gate fires regardless of client-side state — even if the frontend modal is bypassed (e.g., by a custom integration), the server blocks submission until acceptance metadata is present.

The consent disclosure applies to all submitters on the template. If you need different consent behavior per role, create separate templates for each role.

The full statutory disclosure text is always available at /legal/esignature-disclosure, and the modal links to it regardless of custom body text. This ensures signers always have access to the complete federally-required information.

Getting Started

Core Guides

Embedding

Features

Security & Compliance

Legal

ESIGN Consent Disclosure

How it works

Configuration

Template preferences

Disabling for B2B templates

Re-enabling

Builder UI

Audit trail

Submission gate

​ESIGN Consent Disclosure

​How it works

​Configuration

​Template preferences

​Customizing the modal copy

​Disabling for B2B templates

​Re-enabling

​Builder UI

​Audit trail

​Submission gate

ESIGN Consent Disclosure

How it works

Configuration

Template preferences

Customizing the modal copy

Disabling for B2B templates

Re-enabling

Builder UI

Audit trail

Submission gate