Double opt-in refers to an email signup confirmed in two steps: the visitor enters their address, then clicks a validation link received by email before actually joining the mailing list. Without that click, the address stays pending and receives no campaigns. Single opt-in, by contrast, validates the signup as soon as the form is submitted, with no extra step. The choice between the two directly shapes the quality of your list, your deliverability rate, and how solid your GDPR consent proof is.
What does the term opt-in mean in marketing?
Opt-in refers to knowingly choosing to take part in a commercial communication. In digital marketing, the term covers collecting a visitor’s consent before sending newsletters or promotional messages by email or SMS.
“Opt-in means obtaining the recipient’s agreement to advertising in advance.” (CNIL)
The person agrees to join the company’s contact list and gives it permission to send them news, offers, or product updates afterward. Failing to follow this principle is an offense punishable by a fine of up to €750 per unsolicited message.
How does single opt-in (SOI) work?
Single opt-in (SOI), sometimes called simple opt-in, validates the signup as soon as the visitor fills out a form or checks a box. No further verification takes place: the address joins the list immediately, whether it’s to receive a newsletter or download a guide.
This simplicity maximizes the form’s conversion rate. It also exposes the list to mistyped addresses, fake domain names, or bot-filled entries with no real intent behind them. Giving consent doesn’t exempt you from respecting its scope: the messages you send must match what the visitor actually signed up for.
What is double opt-in (DOI) and how does it work?
Double opt-in (DOI) adds a verification step after the form. Once the address is entered, an automatic email goes out to that contact with a link to click to confirm the signup. Until the link is activated, the address stays in “pending” status and receives no campaigns. Only that click unlocks sending.
This mechanism confirms two things at once: that the address actually exists, and that the person who signed up genuinely has access to it. A form filled out by mistake or by a bot never gets past this step, and neither does an address with a typo in the domain name.
Confirmation links generally expire within 24 to 72 hours, depending on the email service provider. After that, the address is purged from the queue or has to go through the form again. A GetResponse study measured an average open rate of 35% on campaigns sent to a double opt-in list, compared with 27% for single opt-in, with click-through rate also higher on the DOI side.
Single opt-in vs. double opt-in: the comparison
The table below compares the two methods on the criteria that actually matter for a campaign: the volume of contacts collected, list cleanliness, and the impact on bounce rate.
| Criterion | Single opt-in (SOI) | Double opt-in (DOI) |
|---|---|---|
| Form conversion rate | Higher, immediate signup | Lower: average loss of 39% to 61% between the form and confirmation (Mailchimp) |
| List quality | A mix of real addresses, typos, and fake contacts | Addresses validated by a click, a tighter list |
| Deliverability | Exposed to unfiltered hard bounces and spam traps | Strengthened: only active addresses receive campaigns |
| GDPR compliance | Consent proof is harder to produce in the event of an audit | Timestamped confirmation email, concrete proof of consent |
| Bot protection | None, a script can mass-fill the form | Effective, a bot won’t click a link received by email |
| Friction for the subscriber | None, a single action is enough | One extra step, some legitimate subscribers never open the confirmation email |
Confirmation rates vary widely from one sector to another. At Mailchimp, the share of signups completing the double opt-in process dropped to 39% in 2017, compared with confirmation rates of 65% to 90% measured by HubSpot depending on the sector and the type of offer. The gap comes down to what the subscriber expects. Context matters more than the method: a business contact downloading a white paper confirms more readily than an everyday newsletter subscriber. Either way, the list that survives double opt-in is smaller but holds up better over time, which protects sender reputation and the signals reported by Gmail’s Postmaster Tools, both directly tied to the deliverability of your future campaigns.
Is double opt-in required under GDPR?
No, GDPR doesn’t explicitly require double opt-in, and neither does the CNIL. The regulation only requires that consent be clear, specific, and documented, and that the company be able to prove it at any time.
The CNIL views double opt-in as a best practice that makes this proof easier to produce: the confirmation email carries an archived timestamp showing that a specific person validated their signup on a given date. In the event of a complaint or an audit, that record carries more weight than a checked box on a form.
Some European authorities go further. Germany’s data protection authority (BfDI) treats double opt-in as a near-mandatory requirement for any commercial email, a stricter stance than the one taken in France. A company sending to German contacts is well advised to apply DOI by default, regardless of its policy for the rest of Europe.
How do you set up double opt-in?
Setting up double opt-in comes down to 4 settings. Nothing complicated here. Brevo and Mailchimp offer the option natively; ActiveCampaign and HubSpot offer it too.
- Turn on the signup confirmation option in your form settings, usually labeled “double opt-in” or “confirmed opt-in.”
- Write a short confirmation email, sent from an identifiable, monitored address — never a noreply address the subscriber can’t reach if something goes wrong.
- Set the link’s expiration window between 24 and 72 hours, and set up a thank-you page after the click to create a positive first touchpoint.
- Schedule a single reminder if the subscriber hasn’t confirmed within 24 hours, then purge unconfirmed addresses after a week.
This last step is a matter of list hygiene, and it matters just as much as the confirmation itself. Banning the noreply address from the confirmation email also improves the response rate: a hesitant subscriber can reply directly to flag an issue.
Also remember to clean up your mailing lists before switching to double opt-in. A legacy database built on single opt-in often contains outdated addresses that will never open the confirmation email, which artificially inflates the measured drop-off rate.
An address confirmed via double opt-in can still turn into a bounce
Clicking the confirmation link proves the contact’s intent. It doesn’t protect against a typo in an otherwise valid domain (gmial.com instead of gmail.com), a mailbox that has become a catch-all accepting everything without checking whether the recipient actually exists, or a work address that stops existing after someone changes jobs. These cases sail through double opt-in without a hitch, then resurface months later as a hard bounce: an NDR (Non-Delivery Report) carrying an Enhanced Status Code 5.1.1, the signal that a mailbox provider will never deliver to that address again.
Email verification before sending and double opt-in then serve two distinct functions: the first confirms intent at a given moment, the second checks the address’s actual status on every campaign. Single opt-in paired with systematic verification via CaptainVerify strips out invalid addresses and risky catch-alls before the first send, without putting the list through the 61% drop-off rate Mailchimp measured on the confirmation journey. A poorly cleaned list also drives up the complaint rate reported through ISP feedback loops, a signal that damages sender reputation almost as fast as a spike in hard bounces.
This is the typical hesitation for a growth team that already has Brevo or an automation platform in place: adding a verification layer looks like one more tool in an already crowded stack. The check runs before sending, on invalid addresses flagged upstream, without touching the form or the existing email sequence. A team that sees deliverability drop 30% over 3 months with no change on the content side will most often trace the cause back to a silent rise in hard bounce. Running a list built on single opt-in through a filter before the next campaign remains the only way to know whether it actually holds up.
What about opt-out?
Opt-out flips the logic: the company keeps sending messages until the recipient explicitly objects. The principle remains legal in specific contexts, such as B2B prospecting to a generic business address, but it’s the exception rather than the rule in consumer marketing.
Every email must then include a visible unsubscribe link, usable even by someone who never signed up voluntarily. A subscriber who clicks that link must be removed from the list immediately, with no reconfirmation or extra email to verify their choice.
Frequently asked questions about double opt-in
Is double opt-in required under GDPR? No. GDPR requires proof of consent without mandating any particular method. The CNIL recommends double opt-in as a best practice, and the German authority (BfDI) treats it as near-mandatory for emails sent to Germany.
Should you choose single or double opt-in? Double opt-in makes sense for sensitive sectors (healthcare, finance) and campaigns that prioritize deliverability over volume. Single opt-in works for a fast launch, provided you verify addresses before sending to make up for the lack of confirmation.
How does double opt-in actually work? The visitor fills out a form, receives an email with a confirmation link, and clicks it to activate their signup. Without that click, the address stays pending and never enters the active list.
How does opt-out differ from standard opt-in? Both opt-in and double opt-in require prior agreement: a simple declaration for one, an email confirmation for the other. Opt-out flips the logic: sending continues until the recipient objects, with no initial agreement required.
The choice between single opt-in and double opt-in comes down to your priorities at the time: collection speed versus list quality. Whichever mode you choose, verifying emails before sending limits the bad surprises that slip through both methods.
