Compliance

Double Opt-in

Definition

Double opt-in (also called confirmed opt-in) is a sign-up process where a new subscriber must confirm their address before they are added to your list. After the form is submitted, you send a verification email with a unique link, and only a click on that link finalises the subscription. It proves the address is real, that its owner genuinely wanted in, and gives you timestamped evidence of consent.

  • A confirmation click is required before the address joins your list
  • It proves the address is real and that its owner truly consented
  • It blocks typos, fake sign-ups, and many spam traps at the door
  • The clearest routine proof of consent for GDPR, though not strictly mandated
At a glance
Also called Confirmed opt-in (COI)
Contrast with Single opt-in
Confirms via A unique link in a verification email
Main benefit Provable consent + clean list
GDPR status Recommended, not strictly required
Effect on list Smaller but far higher quality

How double opt-in works

The difference from single opt-in is one confirmation step. With single opt-in, submitting the form adds the address straight to your list. With double opt-in, submitting the form puts the address in a pending state and triggers a verification email; the subscription only completes when the recipient clicks the unique confirmation link inside it. If they never click, they are never added.

That single click does a lot of work at once. It confirms the mailbox actually exists and accepts mail, it proves a real person controls the address and wanted your email, and it creates a timestamped record of consent. It also weeds out typos and people entering someone else’s address, both of which quietly poison a single-opt-in list.

Why it protects deliverability

A double-opt-in list is smaller, but almost every address on it is genuine and engaged, and engagement is what mailbox providers reward. Three deliverability wins follow directly:

  • Fewer hard bounces. Invalid and mistyped addresses never make it onto the list, so your bounce rate stays low.
  • Fewer spam traps. A pristine trap will never click a confirmation link, so it never gets added, sparing you a blacklisting risk.
  • Fewer spam complaints. Everyone on the list actively asked to be there, so far fewer recipients hit “report spam” later.

Lower bounces, traps, and complaints all feed your sender reputation, which is why double opt-in is one of the highest-leverage list-building decisions a sender can make.

The double opt-in confirmation flow

A visitor submits the sign-up form
The address is held in a pending state, not yet on the list
A verification email with a unique confirmation link is sent
Does the recipient click the link?
No click: never added Clicked: confirmed
The address is confirmed, added, and the consent is logged

Single opt-in vs double opt-in

Single opt-in Double opt-in
Confirmation step None One click required
List size Larger Smaller
List quality Mixed High
Spam-trap risk Higher Much lower
Proof of consent Weaker Strong, timestamped
Bounce rate Higher Lower

By the numbers

1 click
The single confirmation step that separates double opt-in from single opt-in.
0
Pristine spam traps that can join a true double-opt-in list, since a trap never clicks to confirm.

Common mistakes

Sending the confirmation email to spam
If your verification email lands in the junk folder, real subscribers never confirm and your list silently shrinks. Authenticate properly and keep the confirmation message simple and transactional in tone.
A vague confirmation call to action
Recipients who do not understand why they got the email will not click. Say clearly that they signed up and that one click confirms, and remind them what they will receive.
Counting unconfirmed addresses as subscribers
Anyone who never clicked the link did not consent. Mailing pending or unconfirmed addresses defeats the purpose and reintroduces the bounce and trap risk you were avoiding.

Frequently asked questions

Is double opt-in required by GDPR?
Not explicitly. GDPR requires consent that is freely given and that you can demonstrate, but it does not mandate a specific method, so a documented single opt-in can comply. Double opt-in is strongly recommended because the confirmation click is the clearest proof that the address owner actually consented, and in strict markets like Germany it is effectively the expected standard.
Does double opt-in hurt my list growth?
It produces a smaller list, because addresses that are fake, mistyped, or half-hearted never confirm. But the addresses that remain are real, valid, and engaged, which lifts open and click rates, cuts bounces and complaints, and improves deliverability, so the net value of the list usually rises even as the raw count falls.
What is the difference between single and double opt-in?
With single opt-in, submitting the sign-up form adds the address to your list immediately. With double opt-in, the form puts the address in a pending state and sends a verification email; the address is only added after the recipient clicks the confirmation link. Double opt-in trades a little list size for far better quality and provable consent.
Reviewed by Jennifer Jackson, Email Deliverability Analyst · June 2026 ← Back to glossary