The short answer
Double opt-in (or confirmed opt-in) is a two-step sign-up: the person enters their email in your form, then confirms with one click from the message they receive. No EU or UK law requires it, but it is the most solid way to prove consent, as the GDPR asks, and it keeps your list free of typos and fake sign-ups. In Germany and Austria it is effectively the norm.
How it works
- Someone fills in the sign-up form on your website, on Instagram or at your counter.
- They immediately receive an email with a button to confirm.
- Only when they click do they become a subscriber and get your first welcome email.
- The platform saves the date and time of the sign-up and of the confirmation: that is your proof.
With single opt-in, by contrast, the person is subscribed as soon as they submit the form, even if they mistyped their address or someone else entered it.
Is it required?
Under the GDPR and the UK’s PECR, no: no rule requires double opt-in. But the GDPR (Article 7) asks you to be able to demonstrate consent: who agreed, and when. With single opt-in you cannot rule out that someone signed up another person; with an email confirmation you can.
In Germany and Austria double opt-in is effectively the standard: courts expect anyone sending email advertising to prove consent, and confirmation by email is the recognised way to do it. If you have customers there, turn it on.
Pros and cons
- Proof of consent: date, time and a confirmation from the person’s own inbox.
- A cleaner list: no misspelled addresses and no spam traps.
- Fewer spam complaints: people who confirmed remember you.
- Protection from abuse: nobody can sign others up without them knowing.
There is one downside: some people never confirm, so your list grows a little more slowly. But people who do not confirm would rarely have opened your emails anyway.
How to write the confirmation email
- A clear subject line: “Please confirm your subscription to [business name]”.
- One big button, with text like “Yes, sign me up”.
- No advertising: the confirmation email is only for confirming. In Germany, a confirmation that contains advertising risks being treated as unsolicited advertising itself.
- A recognisable sender, the same one as your newsletters.
- One line for people who did not sign up: “If this wasn’t you, just ignore this email.”
After the form is submitted, show a page asking people to check their inbox, including the spam and Promotions folders.
Double opt-in on Spedito
On Spedito you can turn it on for all new forms in Settings › Privacy, or form by form. The confirmation email goes out in the subscriber’s language, and the confirmation is saved on the contact’s profile together with the source, date and time.
To prevent abuse, we never send the same person more than one confirmation every ten minutes, or more than three a day. The rest is explained in Forms and sign-up pages.
Frequently asked questions
Does double opt-in apply to imported contacts?
No, it applies to people who sign up through a form. For imports the usual rule applies: only upload people who agreed to receive your emails, and keep a record of where the list came from.
How many people do not confirm?
It depends on your audience and on how clear the page after sign-up is. To lose fewer, send the confirmation straight away with a clear subject, and ask people to check their spam folder too.
Can the confirmation email include a discount?
Better not: it should only be for confirming. Put the discount in the first welcome email, which goes out after the confirmation.
What should I keep as proof?
The date and time of the sign-up and of the confirmation, where it came from (which form) and the wording of the consent. On Spedito it is all saved automatically.