Answer

What is double opt-in?

Single opt-in trusts the form submission. Double opt-in trusts the click that follows. The second step is what turns a signup into a legally defensible, deliverability-friendly subscriber record.

Start free trial See pricing

Short answer

Double opt-in is a two-step email subscription process where someone enters their address on a form, then clicks a confirmation link in a verification email before being added to the mailing list. Until that click lands, the contact sits in a pending state and receives no marketing. The pattern filters out typos, bots, and malicious signups, improves deliverability, and satisfies strict consent laws like German and Austrian interpretations of GDPR.

Key points

What matters most.

The six things to know before deciding whether to run single or double opt-in, and the legal and deliverability tradeoffs that drive the choice.

Definition

Signup, then a confirming click.

A subscriber submits an email address on a form. The system sends a verification email with a unique confirmation link. The address only becomes an active subscriber after that link is clicked. Until confirmation lands, the record is pending and receives no newsletters, campaigns, or promotional sends.

Why teams run it

Fewer bad addresses on the list.

Typos, role addresses, abandoned mailboxes, and bots that scrape forms never clear the second step. The addresses that do confirm belong to a real human who had the inbox open within a few minutes of signing up. The list that emerges is smaller, but almost every record on it is reachable.

Legal weight

Required in some regions, safer in all.

German and Austrian regulators interpret GDPR as effectively requiring double opt-in for marketing consent, and courts there have fined senders that could not prove the confirming click. Most of the EU, the UK, and Canada under CASL accept documented single opt-in, but double opt-in produces the strongest audit trail.

Deliverability

Mailbox providers reward it.

Gmail, Outlook, and Yahoo weigh engagement signals (opens, clicks, replies, no spam complaints) when deciding whether future sends land in the inbox or the promotions tab. A list of confirmed subscribers engages at a higher rate than a list of raw form captures, which lifts the sender reputation that gates every future campaign.

The tradeoff

You will lose signups to the second step.

Not everyone opens the confirmation email. Common drop-off rates sit between 10 and 30 percent of form submitters, depending on the audience, the subject line, and whether the confirmation email lands in the primary inbox or the promotions tab. The teams that accept the drop get a healthier list; the teams that cannot accept it stay on single opt-in.

Modern alternatives

Confirmed opt-in and verified single opt-in.

Confirmed opt-in sends a welcome email that explains the subscription and offers a one-click unsubscribe, without blocking delivery on a confirmation click. Verified single opt-in uses real-time email validation (syntax check, MX lookup, risk score) to catch typos and disposable addresses before accepting the submission. Both aim to narrow the gap between the two historical choices.

How it works

The four steps between form submit and active subscriber.

Every double opt-in flow, no matter the vendor, runs the same four steps in sequence. Understanding each one is the difference between a confirmation flow that converts cleanly and a flow where half the pending subscribers never make it through.

Step one

Form submission is captured.

The subscriber enters an email on a landing page, popup, inline form, or checkbox at checkout. The record lands in the CRM with a status of pending. No marketing is sent to that address yet. The source, timestamp, IP address, user agent, and form identifier are logged for the audit trail required under GDPR Article 7.

Step two

Confirmation email goes out.

A transactional email is sent immediately with a unique, signed, time-limited link that identifies the pending record. The subject line, from name, and body are branded enough to be recognized, plain enough to pass spam filters. Transactional sending domains are used, not marketing domains, so the message is not blocked by promotional filters.

Step three

Subscriber clicks the link.

The click hits a confirmation endpoint that validates the signed token, checks the expiry window, flips the contact status from pending to active, and records the confirming IP and timestamp. A branded thank-you page confirms the subscription and often offers a next action, such as a welcome discount or a content download.

Step four

Marketing starts, suppression kicks in.

The now-active contact enters campaigns, nurture flows, and segmentation. Pending records that never confirmed are moved to a suppression list after a defined window (typically seven to thirty days), where they can be re-engaged on a specific future campaign but are excluded from the main list and from mailable segments.

The signed token

Why the link cannot be forged.

The confirmation link encodes the pending record ID and expiry in a token signed with a server-side secret (HMAC or JWT). The server can verify the token without a database round-trip, and a tampered or expired link is rejected with a clear error. This is what prevents bad actors from confirming someone else into the list.

The audit record

What regulators want to see.

For every active subscriber, the system can produce the submission timestamp and IP, the confirmation email send record, and the confirmation click timestamp and IP. That three-event chain is the evidence regulators and courts in the EU look for when a complaint is filed. Without it, the sender has to prove consent by other means.

Single vs double

The honest comparison.

The debate between single and double opt-in has run for twenty years and will never be settled, because the right answer depends on the audience, the jurisdiction, and the kind of content being sent. The useful question is not which is better in the abstract, but which fits the specific list, the specific risk tolerance, and the specific deliverability baseline.

Single opt-in

The address goes live on submit.

The subscriber enters an email on the form and is active immediately. The next campaign send includes them. Conversion is highest, friction is lowest, and the list grows fastest. The tradeoff is a higher rate of typos, role addresses, bots, and uncommitted subscribers, which drags engagement down over time.

Double opt-in

The click is the gate.

The subscriber confirms with a click before anything is sent. Signup conversion drops ten to thirty percent, but the list that remains is cleaner, more engaged, and legally defensible across every jurisdiction. The flow is standard in Germany, Austria, and much of the EU, and increasingly common in the US on high-stakes lists.

List quality

Double wins on open and click rate.

A confirmed list typically outperforms a single-opt-in list on open rate, click rate, and complaint rate because every active record proved reachability and attention within minutes of signup. The quality lift tends to compound over months as mailbox providers raise the sender reputation of a well-engaged list.

List size

Single wins on raw volume.

If the goal is pure volume, every record counts, and the audience is low-risk from a legal perspective, single opt-in produces a larger addressable list. The common scenario is top-of-funnel B2C lead magnets where a short-term campaign push is worth more than the long-run engagement curve.

Legal exposure

Double is the safe default globally.

A single-opt-in list that mails into Germany, Austria, or any jurisdiction with aggressive consent enforcement is a legal risk that only matters until a complaint is filed. A double-opt-in list has the audit trail to answer that complaint. For teams that cannot afford a GDPR enforcement action, double opt-in is the cheaper policy.

Deliverability

Double protects the sender reputation.

A single opt-in list collects spam traps and typo addresses that generate hard bounces, pumping down the sending domain reputation. Mailbox providers then route legitimate campaigns to the spam folder. A double-opt-in list bounces far less, which is why most deliverability consultants recommend it on any list that mails to five figures or more.

How a CRM runs it

What the system does for you.

The mechanics are the same across platforms. What changes is how much of the flow is wired by default and how much the operator has to build. A modern CRM ships the confirmation template, the pending state, the suppression list, and the audit trail as first-class features rather than add-ons bolted together with automation.

Confirmation template

A reusable transactional email.

The CRM stores the confirmation email as a template with merge fields for the subscriber name, the signed confirmation link, and the brand assets. The template is edited once, versioned, and used by every form on the site. A fallback plain-text version is included for mailbox clients that strip HTML, which some corporate filters still do.

Pending state

A first-class contact status.

The contact record carries a subscription status field with values like pending, active, bounced, unsubscribed, and complained. Every segment, campaign, and automation respects that status by default. Pending contacts never receive marketing. Reports and dashboards break out pending counts so operators see the funnel from signup to confirmation.

Automated reminders

One nudge, then suppression.

If the confirmation click does not land within a defined window (typically 48 to 72 hours), the system sends a single polite reminder. If a second window closes without a click, the record is moved to a suppression list. The reminder is what recovers five to fifteen percent of the pending signups that would otherwise be lost to inbox clutter.

Suppression list

The addresses marketing never retouches.

Expired pending records, unsubscribers, hard bounces, and complainers live in a suppression list that every campaign send checks before dispatch. The list is permanent, not segment-based, so an operator who imports an old file cannot accidentally re-mail someone who already said no. This is a GDPR Article 17 requirement in practice.

Audit trail

Three timestamps per record.

For every active contact, the system records the form submission event, the confirmation email send event, and the confirmation click event, with IP, user agent, and form source for each. On request, the operator can export a per-contact audit log in minutes, which is what satisfies a GDPR data subject access request or an EU regulator inquiry.

Preference center

One place to change consent.

An authenticated page where the subscriber can see every list they joined, when they confirmed, which topics they consent to, and how to withdraw consent for any of them. The preference center is where double opt-in connects to GDPR Article 7 withdrawal rights and to CAN-SPAM one-click unsubscribe requirements in the US.

Run double opt-in without stitching three tools together.

Strkr ships the confirmation template, the pending state, the audit trail, and the suppression list as first-class CRM features, not add-ons glued together with automation. One platform runs the signup, the confirmation flow, the segmentation, and the compliance evidence.

Start free See the platform

Related questions.

Is double opt-in required by GDPR?

GDPR itself does not name double opt-in. Article 7 requires that consent be freely given, specific, informed, and demonstrable, and double opt-in is the cleanest way to produce the evidence of that consent. German and Austrian regulators and courts have treated double opt-in as effectively mandatory for marketing email, and fines have been issued against senders that could not prove the confirming click. Elsewhere in the EU, documented single opt-in is often accepted, but double opt-in is the safer default.

What is the difference between double opt-in and confirmed opt-in?

Terminology varies by vendor. In the strictest usage, double opt-in requires a confirming click before any marketing is sent, while confirmed opt-in sends a welcome email that includes an easy unsubscribe but does not block delivery. In practice many vendors use the terms interchangeably. The question that matters is whether the subscriber is marketed to before the confirming click happens or after.

How much does double opt-in reduce signups?

Typical confirmation rates sit between 70 and 90 percent of form submitters, which means 10 to 30 percent of signups are lost to the second step. The variation comes from audience familiarity with the brand, confirmation email deliverability, subject line clarity, and the time of day the signup happens. Teams that invest in a strong confirmation subject line and a transactional sending setup usually land in the 85 to 90 percent range.

Does double opt-in improve email deliverability?

Yes, measurably. A confirmed list engages at a higher rate than a single-opt-in list because every active record proved reachability and attention. Higher engagement rates lift the sender reputation that Gmail, Outlook, and Yahoo use to decide inbox versus spam placement. Over months, that reputation gain compounds, which is why most deliverability consultants recommend double opt-in on any list of real size.

When should a company use single opt-in instead?

Single opt-in makes sense when raw list volume matters more than engagement, the audience is low-risk from a legal perspective, and the sending program has strong real-time email validation to catch typos and disposable addresses on submission. Common scenarios are B2C lead-magnet downloads, one-time event registrations, and transactional product signups where the follow-up marketing is light and the unsubscribe experience is prominent.

What happens to pending subscribers who never confirm?

They sit in a pending state for a defined window, usually 7 to 30 days, during which the system may send one reminder email. If the confirmation click never lands, the record is moved to a suppression list, which prevents it from being included in any future campaign. The record is retained for audit purposes but is treated as if the person said no, because consent was never confirmed.

Does CAN-SPAM in the United States require double opt-in?

No. CAN-SPAM governs how commercial email is sent and unsubscribed from, not how consent is collected, and it does not require any opt-in process at all. US senders can mail cold on an opt-out basis if they comply with the identification, physical address, and unsubscribe rules. Double opt-in is still common in the US because of deliverability benefits and because any list that crosses into the EU triggers GDPR, which does require demonstrable consent.

How long should the confirmation link stay valid?

A common window is 24 to 72 hours. Shorter windows protect against stolen tokens and signal urgency, which can nudge the subscriber to confirm. Longer windows capture people who do not check the inbox the day they signed up. The link itself should be a signed, single-use token that expires automatically and cannot be forged, with the server rejecting any confirmation attempt outside the window.

Try it free. Bring your team next week.

No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.

Start free trial See pricing