Is a simple electronic signature legal under UETA? Yes — here's why.

UETA is state law, not federal law

Unlike the ESIGN Act — a federal law — the Uniform Electronic Transactions Act is a model law each US state adopts on its own. Every state except New York has adopted some version of UETA; New York instead uses its own Electronic Signatures and Records Act (ESRA), which sets a broadly similar bar. If a specific state's law governs your agreement, that state's UETA (or New York's ESRA) is usually what actually applies — not the federal ESIGN Act.

What UETA requires: attribution (Section 9)

UETA §9 says an electronic signature is legally attributable to a person if it was "the act of the person" — and that can be shown by any surrounding circumstances, including how a security procedure was used. It doesn't require biometrics, a certified identity check, or cryptographic signing. A timestamped audit trail — who clicked, from what IP, at what time, in response to a link sent to a specific email — is exactly the kind of circumstantial evidence UETA §9 contemplates.

What UETA requires: record retention (Section 12)

UETA §12 treats an electronic record as satisfying any legal retention requirement if it accurately reflects the information and remains accessible for later reference. A tamper-evident PDF — hashed so any edit after signing is immediately detectable — plus a certificate of completion satisfies this without needing a specialized records-management system.

What UETA does not require

• Identity verification of the signer
• A specific signature technology or vendor
• Biometric or cryptographic certificates
• A notary or witness

Where a simple signature isn't enough

UETA has carve-outs: wills, codicils, testamentary trusts, and certain family-law and court documents are typically excluded from electronic execution entirely, regardless of signature strength. For anything outside UETA's scope, or where a counterparty specifically requires notarization or a Qualified Electronic Signature, use the appropriate dedicated process instead.