Double opt-in in the EU: when it is required and how to implement it

Double opt-in means a subscriber confirms their address by clicking a link in an email before they receive anything else. It is the most argued-about setting in email marketing, mostly because people look for one rule across the EU and there is not one.

The GDPR sets the standard for consent — freely given, specific, informed, unambiguous, and demonstrable. It does not prescribe a mechanism. National data protection authorities and national marketing law fill that gap differently.

Where it is effectively expected

Germany is the clearest case: the courts and the supervisory authorities have long treated confirmed opt-in as the way to prove consent for commercial email, and single opt-in is a risk most German shops do not take. Austria is similar in practice. Several other authorities recommend it strongly in guidance without making it black-letter law.

In most of the rest of the EU, single opt-in with a proper record is lawful. "Proper record" is doing all the work in that sentence, and it is where shops actually fail.

What the record has to contain

Article 7(1) puts the burden on you to demonstrate consent. A boolean column does not demonstrate anything. What you need, per subscriber:

1. When — a timestamp, stored in UTC.
2. How — which form, which page, which campaign. "Checkout newsletter box" and "footer form" are different consents.
3. What they were told — the exact wording shown at the time, versioned. If you change the wording, old consents are evidence of the old wording, not the new one.
4. What for — the channel and purpose. Email consent is not SMS consent.

How to implement it

1. Never pre-tick the box. This is not a grey area: a pre-ticked box is not consent, and that has been settled since Planet49.
2. Separate the consents. One box for the newsletter, one for SMS. A single box covering "marketing" is not specific.
3. Send the confirmation immediately and make the link obvious. Anything slower than a minute loses people who are still on the page.
4. Record the confirmation click with its own timestamp and IP. This is the evidence, more than the original submission.
5. Expire unconfirmed sign-ups after 30 days and delete them. An unconfirmed address is not a subscriber and keeping it is its own compliance problem.

The honest cost

Double opt-in loses subscribers. Typically 10–30 % never click the confirmation, and a share of those genuinely meant to subscribe — the email went to spam, or they got distracted.

What you get back is a list that engages better, bounces less and complains less, which is worth real money in deliverability terms. The people who do not confirm were rarely going to buy. It is still a trade, and it is worth making the decision deliberately rather than inheriting whatever your tool defaults to.

The checkout box is the hard case

Most shop subscribers arrive at checkout, and that is where the rules bite hardest. Two lawful patterns:

• An unticked box at checkout, clearly labelled, separate from the terms acceptance. Then a confirmation email if you have chosen double opt-in.
• The soft opt-in for existing customers, where national law allows it: you may market similar products to somebody who bought from you, provided they were offered an opt-out at the point of sale and in every message. Check your own national implementation — this varies, and it does not cover people who never bought.

What is not lawful anywhere: subscribing every customer automatically because they placed an order.