Double opt-in

What it means

Double opt-in is a two-step newsletter sign-up. A person first enters their email in a form and then receives a message with a link to confirm. Only after they click is the address added to the list and newsletters start arriving.

The second step checks two things: that the address exists and that its real owner entered it. Without confirmation anyone could sign up someone else’s address, by mistake or on purpose, and the company would then be sending unsolicited mail to people who never asked for it.

GDPR does not expressly require double opt-in, but it is the most reliable way to prove consent. The system records the time of sign-up, the time of confirmation and the IP address, which serves as evidence in a complaint or inspection.

How it works in practice

When setting up email marketing, we recommend double opt-in as the default. The confirmation email should be short, with a clear button and information on what the person will receive and how often, plus a link to the privacy notice under the duty to inform.

So that confirmation messages do not land in spam, the sending domain should have SPF, DKIM and DMARC set up. Otherwise many people never complete the sign-up and the company thinks the form is broken.

Consent records must be kept for as long as the newsletter is sent and for a reasonable time after unsubscribing. When moving to another mailing tool they should be transferred together with the contacts, not just the addresses.

What to watch out for

A common mistake is putting advertising or a discount code straight into the confirmation email. Until the person confirms, the company has no consent, and the confirmation message should serve only to confirm.

The second risk is importing an old contact list without provable consent into the tool and treating it as double opt-in. Consent cannot be obtained retrospectively, and a mass mailing to such a list can lead to complaints and a blocked domain.