What Is Double Opt-in?

Double opt-in is the two-step signup process used by email lists and newsletters. The person fills in a form with their email address and, before receiving any message, has to confirm that signup by clicking a link inside a verification email. Only that click activates the subscription.

The procedure serves two distinct purposes. It stops someone from entering a stranger's address without that person's knowledge, a common problem with publicly open forms. And it leaves a verifiable technical trail of the exact moment that person gave their approval, including the IP address the confirmation link was clicked from.

That second point is why double opt-in has become the standard for email marketing in Germany. It doesn't describe how consent works in general, that's already covered by the GDPR as the broader framework, but how that principle applies specifically to an email signup, usually the first formal touchpoint in an email subscriber's customer journey.

In Germany, single opt-in leaves the controller with no solid way to prove that the actual owner of the address was the one who asked to receive emails, a gap that becomes decisive if a complaint comes in.

The process starts with a signup form, usually on a website or landing page, where the user types in their email address. At that point, no commercial content gets sent: the system automatically generates a confirmation email with a unique link, different for each signup and each attempt. Most email marketing platforms ship with this mechanism built in, with no custom coding required.

If the person clicks that link, the system logs the confirmation with date, time, and IP address, and only then does the address move to active status on the list. From that point it can start receiving the newsletter or the campaigns it consented to, a routine step in any inbound marketing strategy that grows subscribers through its own forms instead of purchased lists.

If nobody clicks the link, the address sits in an intermediate, unconfirmed state, without receiving anything in the meantime. Leaving it there indefinitely isn't good practice: after a reasonable window, 24 to 72 hours is common, it should get deleted automatically instead of sitting around with no activity and no legal basis for sending anything. That regular cleanup also keeps the list healthier and saves sending capacity on addresses that never got activated.

The term double opt-in doesn't appear anywhere in the GDPR or in Germany's law against unfair competition (UWG): no article names it or requires it word for word. The obligation is indirect, and it's worth being precise about where it actually comes from.

The starting point is Article 7(1) of the GDPR, which puts the burden of proof on the controller: it's the controller who has to be able to show that the person gave consent, not the other way around. Just storing an email address in a database proves nothing on its own.

Building on that, Germany's Federal Court of Justice (BGH) ruled on February 10, 2011 (case I ZR 164/09) that merely logging an IP address, alongside the claim that consent came from that address, isn't enough as proof. It requires fuller documentation: the entire opt-in process, including the exact wording the person agreed to.

The Datenschutzkonferenz (DSK), which brings together Germany's federal and state data protection authorities, folded both elements into its February 2022 guidance on direct-marketing data processing: it calls double opt-in "geboten" (required) for electronically verifying a consent declaration, pointing explicitly to that BGH ruling for the documentation standard. That guidance carries no legal force of its own, it reflects the joint position of the supervisory authorities, but in practice it's the yardstick they use to assess any complaint. That's why double opt-in isn't an explicit legal mandate, but the practical route to meeting the proof obligation in Article 7(1).

• Send the confirmation email within minutes of signup, with no commercial content beyond the confirmation request itself.
• Log the date, time, IP address, and exact consent wording for every confirmation, as required by BGH case law.
• Automatically delete signups that stay unconfirmed past a reasonable window, instead of keeping them indefinitely as pending.
• Give each confirmation link a single purpose: don't use it to slip in another signup or a change of terms.
• Make unsubscribing just as easy as signing up, with a visible link in every send.
• Keep the consent record in your CRM even after someone unsubscribes, as evidence against a future complaint.

• Treating double opt-in as a minor formality instead of the legal proof that every later send depends on.
• Storing only the source IP address and assuming that's enough proof of consent, something the BGH explicitly rejected.
• Letting unconfirmed signups pile up in the database for months, with no time limit and no automatic deletion.
• Confusing double opt-in with list segmentation: they're different processes, one validates the signup and the other organizes who's already subscribed.
• Putting promotional content directly in the confirmation email, which can turn that send itself into unconsented advertising.