Double Opt-in: Definition, How It Works, GDPR and Setup

Double opt-in (DOI) is a two-step signup: the address typed into a form joins your list only after the subscriber clicks the link in a confirmation email. Neither the GDPR nor the CNIL, France’s data protection authority, requires it. This guide gives the exact legal rule, the fields to archive as proof, a confirmation email template you can copy and a method for migrating an existing list. It includes a decision tree that weighs DOI against single opt-in, then adds address verification.

It also covers the setup in Brevo, Mailchimp, HubSpot and ActiveCampaign.

The signup flow, from form to active subscriber

DOI runs in five steps. The subscriber only sees three of them.

1. The visitor types their address into a form and ticks a consent box that is empty by default.
2. The email tool creates the contact with a “pending” status and attaches no campaign to it.
3. A confirmation email goes out within a minute, with a single-use link.
4. The click activates the contact. The tool records the timestamp and IP of the click.
5. A thank-you page appears, followed by the welcome email.

Pending status and link expiry

A “pending” contact receives no campaign, not even the newsletter sent the same day. The confirmation link has a validity period, which each tool sets in its own way: read its documentation before promising a deadline (the template below says 48 hours, adjust it). Once the link expires, the visitor has to go through the form again. A window that is too short loses the people who open their email in the evening or the next day.

Single opt-in and opt-out: the two other modes

Single opt-in (SOI) validates the signup as soon as the form is submitted. No confirmation email is sent. The visitor gets the first campaign with no further action. Consent does exist. Nothing proves that the address belongs to the person who typed it.

Opt-out flips the logic: the company keeps writing until the recipient says no. The CNIL sums up opt-in in one sentence (“if they haven’t said yes, it’s no”), which rules out opt-out for consumer prospecting. Every message must carry a working unsubscribe link, and leaving the list must be immediate, with no reconfirmation.

Comparison: confirmation, bots and proof

The two methods differ on six criteria, from the number of subscribers kept to the proof you can show in an inspection.

The last row needs a caveat: the risk returns later, as the section on bounces explains.

Expected confirmation rate

Only one statistic can be traced back to a source: a 39% confirmation rate, meaning 61% drop-off, reported by John Foreman, Chief Data Scientist at Mailchimp, in October 2017 to justify making single opt-in the default on 31 October 2017 (existing forms of customers based in the EU stayed on DOI, out of GDPR caution). The figure comes from a repost on the German blog emailmarketingtipps.de, because Mailchimp’s original page is gone: read it as a 2017 order of magnitude, not as a current benchmark. The 50 to 80% ranges that circulate on vendor blogs rest on no published study.

With 10,000 signups a month, a 39% rate leaves 3,900 active contacts. Measure your own: confirmations divided by signups over 30 days, per traffic source, because the rate varies from one form to another.

Anti-bot: DOI, CAPTCHA and honeypot

A CAPTCHA (Google reCAPTCHA, hCaptcha, Cloudflare Turnstile) or a honeypot field stops the bot before the email is sent. DOI stops it afterwards: the bot stays “pending”. Only DOI costs you one send per bot, which matters at high volumes. The two combine without trouble.

What the GDPR, the CNIL and the CPCE say

The rule fits in one line: a positive act by the person, plus the ability to demonstrate it. No text consulted prescribes confirmation by email.

Article 7 and recital 32

Article 7 of the GDPR (Regulation (EU) 2016/679, applicable since 25 May 2018) requires the controller to be “able to demonstrate that the data subject has consented”. Recital 32 describes consent as a clear affirmative act and rules out silence, pre-ticked boxes and inactivity. DOI meets both requirements without being mandated by them: the click is an affirmative act and it leaves a trace.

On its page about collecting consent (published 3 August 2018, updated in 2026), the CNIL adds that consent must be free, specific, informed and unambiguous. The controller must also be able to demonstrate it at any time, for example through a consent register. For email prospecting, it requires a dedicated, non-pre-ticked box: accepting the terms of service is not enough. None of the CNIL pages consulted mentions double opt-in.

Email prospecting: article L34-5 of the CPCE

In France, article L34-5 of the Postal and Electronic Communications Code (CPCE) has set the principle of prior consent for email prospecting of individuals since the law on trust in the digital economy of 21 June 2004. The GDPR framework for email marketing details the consequences for your campaigns. The European ePrivacy directive 2002/58/EC is the origin of this rule.

Proof of consent: the fields to archive

A confirmation click is worth something only if it can be retrieved. For each contact, keep:

• the date and time of the signup, then those of the confirmation click;
• the IP address tied to each of the two steps;
• the exact wording of the consent box and the version of the form displayed;
• the URL of the signup page and the traffic source;
• the ID of the confirmation email that was sent.

Brevo states in its help center that DOI is not required by the GDPR but helps prove the signup, thanks to event logs and transactional emails. Check that your tool exports these fields: a register locked inside the platform disappears with your subscription.

When prior consent is not required

The CNIL page on email prospecting (June 2026) describes two main exceptions. First: you write to a customer about products or services similar to those already bought, after offering them the chance to object at the time of collection (the “soft opt-in” of the English-speaking world). Second: non-commercial prospecting. In B2B, the CNIL accepts prospecting on the basis of legitimate interest: sending to a business address is possible if the message relates to the person’s role and if they were informed and could refuse at collection. For generic addresses of legal entities (info@, contact@, orders@), the CNIL specifies that they are not subject to these principles. In all these cases, DOI stays optional.

The German case

On 10 February 2011, in its “Double-Opt-in-Verfahren” ruling (I ZR 164/09), the German Federal Court of Justice (BGH) held that, once the confirmation is received, it can be assumed that the request does come from the stated address. Consent is then sufficiently documented. The text of the ruling also states that the advertiser must keep the declaration and be able to print it.

One size limit: the ruling falls under German unfair competition law (UWG), not the GDPR. Email DOI does not prove agreement to phone calls. No German law makes it mandatory. It is the burden of proof, carried by the advertiser, that makes it indispensable in practice for anyone sending to Germany.

Setting up confirmation in your tool

The setting sits at a different level in each tool: some enable it for the whole audience, others form by form. Menu labels change over time, so look in the forms or audience section of your account.

Writing the confirmation email

The confirmation email is itself a sensitive message: if the signup cannot be shown, the OLG München treated it as advertising (see the FAQ). Keep it strictly transactional: a clear subject line, one sentence of context, a button, no offer. Here is a template.

Subject: Confirm your subscription to the [Brand] newsletter

Hello,

You just asked to receive the [Brand] newsletter at [address]. Click the button below to confirm. The link stays valid for 48 hours.

[Button: Confirm my subscription]

If you didn’t make this request, ignore this message: no subscription will be recorded.

[Brand], [postal address], [monitored reply address]

Send it from an address that receives replies. Dropping the noreply address lets a hesitant subscriber write to you instead of flagging the message as spam.

Thank-you page, welcome email and reminder

The thank-you page after the click confirms the signup, states the sending frequency and reminds the subscriber how to unsubscribe. The welcome email follows right away and delivers the first promise made (the guide, the discount code). It is the first positive signal sent to mailbox providers.

The reminder: a single nudge at 24 hours for “pending” contacts, then deletion after seven days. A second reminder raises the risk of a spam complaint from someone who confirmed nothing.

Migrating a single opt-in list

Switching to DOI does not retroactively make a poorly documented list valid. Sort first: contacts for whom you hold the collection date and source stay active, provided you can also retrieve the exact wording of the consent. For the others, send a reconfirmation request to a sample of 1,000 contacts, measure the click rate, then extend in waves of 5,000 to 10,000 contacts. Before that send, clean your email list: dead addresses will never confirm and inflate the drop-off artificially.

A confirmed address can still become a bounce

The click proves that someone controls the mailbox at the moment of the click. It says nothing about that mailbox six months later. That is where the deliverability of a “clean” list starts to erode.

Several cases get past double opt-in without a hitch. A work address disappears when its owner leaves the company: the mailbox then returns an NDR (Non-Delivery Report) with SMTP code 550 5.1.1 (“user unknown”), which is a permanent hard bounce. A catch-all domain accepts every message, including for mailboxes that do not exist: the click may come from a tool rather than a person. An abandoned address can later be recycled into a spam trap by some operators. A send to a trap weighs on sender reputation.

Each case can be measured: watch the hard bounce rate in your reports and the spam complaint rate in Google Postmaster Tools for Gmail.

Address checking happens at two distinct moments. At signup, an API verification checks the domain (DNS, MX), tests the mailbox through an SMTP connection and suggests a fix for a typo, before the confirmation link is sent: no email goes to “gmial.com”. According to the API documentation, a full SMTP verification takes about 3 seconds: plan a 20-second timeout and treat any overrun as an “unknown” result. Before a campaign, a check of the whole list flags invalid addresses and risky catch-alls. This check guarantees nothing for the future: a mailbox that is valid today can vanish tomorrow, which is why you rerun it before big campaigns instead of once and for all.

Decision tree: DOI, single opt-in or verification

• You send to Germany or lack proof of your signups: DOI, with the proof fields from the previous section.
• Your form is a B2B lead magnet and every lead feeds a sales sequence: single opt-in, plus address verification at signup, because losing up to 61% of signups (the 2017 Mailchimp figure) can cost more than the risk of a typo.
• Your form is open to the general public and bots are already hitting it: DOI or CAPTCHA, then verification before the first campaign.
• You import a purchased list or one taken over from a partner: none of the three replaces consent obtained at the source. Do not import it.
• You write to your customers about similar products: consent is not required under the exception, DOI is optional, verification before sending.

Frequently asked questions about double opt-in

Does the confirmation email count as prospecting? In Germany, the OLG München (27 September 2012, 29 U 1682/12) treated it as plain advertising when sent without prior consent. Limit it to a confirmation request, with no promotional content. Send it only once.

Does DOI count as consent to calls and SMS? Not for the phone: the BGH ruled in 2011 that email confirmation does not prove agreement to calls. Collect a separate consent for each channel.

How long should proof be kept? The CNIL gives no figure in its pages on consent. Keep it as long as the person stays subscribed and long enough to answer a challenge, then have the duration validated by your data protection officer.

How do you avoid false confirmations? Some corporate security filters open email links before the recipient does and validate a contact without their knowledge. Require a click on a button on the landing page before activating the contact, instead of activating on the mere loading of the link.

Does a B2B lead magnet form require DOI? No: a non-pre-ticked box or the B2B exception described above is enough. DOI there serves to make the address reliable, and an address check at signup answers that at lower cost.