Double opt-in means a new subscriber gets an email with a confirmation link first and only joins your list after clicking it. With single opt-in, the address goes on the list the moment the form is sent. The second step proves that whoever controls the inbox actually wanted the subscription. Whether you need that proof depends on where your readers are. In the EU, the GDPR says that where processing is based on consent, "the controller shall be able to demonstrate that the data subject has consented", and Germany's Act against Unfair Competition (UWG) treats email advertising without prior express consent as an unreasonable nuisance. Neither text uses the words double opt-in; it is simply the common way to make that consent provable. In the US, the FTC's CAN-SPAM guide centers on opt-out and sets no general prior-consent rule, so double opt-in is a choice there. A clean setup has five parts: a form with clear wording, a confirmation email without promotion, a confirmation page, a log with timestamps, and one-click unsubscribe.
This isn't legal advice, just the operator's perspective. I'll walk through the flow of my own newsletter "From the Engine Room" as far as you can click through it on kevinwelter.com. The website is built and technically maintained by Ralf, my AI employee for websites (Build and Modernize a Website With AI).
Double opt-in vs single opt-in
"Confirmed opt-in" is used inconsistently: sometimes as another name for double opt-in, sometimes for the middle row. Check whether your tool requires a click.
The difference matters the day someone says "I never signed up." With single opt-in you have a form entry a bot could have produced; with double opt-in, a click from the inbox with a timestamp.
When is double opt-in required?
The rules that matter, from the primary sources (as of November 2026):
- EU, GDPR Article 7(1): "Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data." The burden of proof is on you.
- EU, GDPR Article 4(11): consent is "any freely given, specific, informed and unambiguous indication of the data subject's wishes", given "by a statement or by a clear affirmative action". On cookies, the Court of Justice of the EU ruled in 2019 (case C-673/17, Planet49) that consent is not valid when given through a pre-checked box the user has to untick. For your form: nothing pre-checked.
- EU, GDPR Article 7(3): "It shall be as easy to withdraw as to give consent." One click in, one click out.
- Germany, UWG section 7(2) no. 2: advertising by email without the recipient's prior express consent is always an unreasonable nuisance. Section 7(3) has a narrow exception for existing customers who bought from you, limited to your own similar products.
- US, CAN-SPAM: the FTC's compliance guide requires a clear way to opt out in every marketing email and opt-out requests honored within ten business days. On members and subscribers it says: "While you don’t need to get members’ consent to send them marketing emails", they can still opt out. A general prior-consent rule is not part of it.
An easy mix-up: section 7a UWG requires documenting consent and keeping that record for five years, but only for advertising by telephone call to a consumer. For email, neither the GDPR nor section 7 UWG sets a fixed retention period; you need the proof for as long as you rely on the consent. With freebies, giveaways or sharing data with partners, have the setup checked legally; the technical flow is something we'll look at together.
Setting up a double opt-in email flow: five parts
1. The form. Only the email address is required. Below it, one or two sentences on what's coming: content, frequency, whether you promote offers, that a confirmation email follows, that unsubscribing is always possible, and a link to your privacy policy. No pre-checked box. After submitting, an interim page: open your inbox, click the link, check spam.
2. The confirmation email. A recognizable sender, a subject that reads like a confirmation, one clear link. No promotion: the email goes out before consent is confirmed. Give the link an expiry and say so in the email.
3. The confirmation page. After the click, a page that says plainly "you're subscribed" and what happens next. For expired or broken links, a separate page that leads back to the form instead of an error. What else belongs on that page is in Thank You Page Examples and What to Include.
4. The log. For each subscriber, store at least the address, the time of sign-up, the time of confirmation, where on the site the sign-up happened and which wording the person saw. When the wording changes, keep the old version with a date. You can also store the IP address, as my site does (see below); whatever you store belongs in your privacy policy.
5. Unsubscribe and suppression list. An unsubscribe link in every email that works without logging in. Anyone who leaves goes onto a suppression list so a later import can't add them back. Never email unconfirmed entries.
If the form sits on a landing page, testing the flow belongs in the pre-launch check described in Create a Landing Page: Guide and Tools.
The flow on kevinwelter.com
On my English pages you sign up for "From the Engine Room" together with a free resource, for example on Free templates for AI employees. The text under each form names the newsletter, "every week, including notes on my trainings and offers", the confirmation link and one-click unsubscribe. Content, frequency, promotion, confirmation and exit, all before the click on submit, because consent has to be "informed".
After submitting you land on "Almost there", with a pointer to the spam or promotions folder. The link in the email opens a confirmation page ("One moment, I'm adding you to the list …", with a button as fallback), then "You're subscribed" with a note that the welcome email is on its way. If the link is too old, the page says: "Confirmation links are valid for seven days, and this one has expired or is incomplete. Just sign up again and you'll get a new one."
What happens before the click is the interesting part. According to my privacy policy (in German, section 7.2), nothing is stored until then: the details travel only inside the link, encrypted and protected against tampering. Only the click adds the address to the list. Stored after that: the address, time and IP address of sign-up and confirmation, to be able to prove consent, and the place on the site where the sign-up happened. The confirmation and welcome emails are not tracked for opens or clicks (section 7.5). Anyone who unsubscribes stays only on a suppression list, as far as needed to stop further promotion (section 7.6). Sending runs on Listmonk, self-hosted (section 7.1).
For Ralf, a sign-up flow is an expansion job: he integrates new functions into the existing system, then checks the build, the mobile layout and the click paths, and nothing goes live without my approval. Legal claims are not his call; according to his page they stay with the client, which is me.
Measuring your confirmation rate
Your confirmation rate is the share of sign-ups that get confirmed. Two rules keep the number honest:
- Count people, not submissions. Someone who submits twice because the first email landed in spam is one person. Counting form events makes the rate look worse than it is.
- Fix the window. Only count sign-ups whose link has already expired, otherwise today's sign-ups show up as unconfirmed.
Hypotheses worth testing, not measured results: a sender name people recognize, sending the confirmation immediately, an interim page that mentions the spam folder, one link instead of several, an expired-link page that leads to a new sign-up. How to test a change like that properly is in Conversion Rate Optimization: Steps and Tests; where sign-up sits in the funnel is in Marketing Funnel Examples: Stages in Practice.
Tools: ready-made or self-built
Two examples of tools with built-in double opt-in. In Listmonk, a list is either single or double opt-in; per the documentation, "Subscribers added to double opt-in lists have to explicitly accept the subscription" and receive no campaigns until they do. Brevo* has a help article on creating a custom double opt-in email for sign-up forms built in Brevo. Either way, check the five parts above. Which tools are free is covered in Newsletter Platforms Compared. What Brevo costs and where it hits limits is in Brevo Review: Pricing, Limits, Alternatives. If you want to leave Mailchimp, see Mailchimp Alternatives (Free and Paid).
* Affiliate link: if you sign up with Brevo or buy a plan through this link, I earn a commission. Your price stays the same.
Frequently asked questions
Is double opt-in legally required?
The term appears neither in the GDPR nor in section 7 UWG. In the EU and Germany, what's required is prior express consent for email advertising and proof of it; double opt-in is the usual way to get both. In the US, the FTC's CAN-SPAM guide centers on opt-out.
What is the difference between double opt-in and single opt-in?
With single opt-in, the address is on the list as soon as the form is sent. With double opt-in, only after someone clicks the link in the confirmation email. Only the second shows that the inbox belongs to the sign-up.
How long do I have to keep the proof?
For email, the GDPR and section 7 UWG set no fixed period; you need it for as long as you rely on the consent. The five years in section 7a UWG apply to telephone advertising to consumers.
What happens to sign-ups that are never confirmed?
They get no issues. According to my privacy policy, nothing is stored before the click, and the link expires after seven days. If your tool stores unconfirmed entries, delete them once the link has expired.
Where to go from here
Sign up on Free templates for AI employees and look at the flow from the inside: form wording, interim page, confirmation email, confirmation page, welcome email. Then compare yours, part by part. If you'd rather not build the flow yourself, see how Ralf works. How the whole newsletter comes together, from the list to the first issue, is in How to Start a Newsletter: My Own Setup.
