Double opt-in adds one step between a signup and your list: the new subscriber gets a confirmation email and only becomes active once they click the link. Ask five marketers about it and you will get five confident, contradictory answers - it is either "required by GDPR" or "a conversion killer", depending on who you ask. Both claims are wrong. This article lays out what double opt-in actually costs, what it actually buys, what the law actually says, and when each mode is the right call.
The honest cost: a meaningfully smaller list
Some people who sign up will never click the confirmation link. The email lands in spam, the moment passes, the address had a typo, or the interest was thin to begin with. Depending on your audience and how good the confirmation email is, the drop-off is commonly somewhere between one in ten and one in three signups. That is the real price, and it is not nothing - if you paid for the traffic that produced the signup, unconfirmed subscribers are money spent on contacts you are not allowed to mail.
But look at what actually drops off: typos that would have bounced, bots that would never have opened anything, and people whose interest did not survive one click. The subscribers you lose are disproportionately the ones who were going to hurt your metrics anyway.
What you get in return
- A list that behaves. Everyone on it proved the address works and that they wanted in. Open and click rates rise, and spam complaints - the number Gmail and Yahoo now enforce hard ceilings on - fall.
- Protection from junk signups. Giveaway entrants, competitors' bots and mistyped addresses never reach your active list. Spam traps, which can genuinely damage your sender reputation, rarely confirm.
- Consent you can show someone. Every confirmed subscriber carries a timestamped record: when they signed up, from which source, and when they clicked confirm. If a complaint or an audit ever asks "prove this person opted in", you have an answer.
What GDPR actually requires
GDPR never mentions double opt-in. What it requires is valid, demonstrable consent: freely given, specific, informed, and something you can prove afterwards. A single opt-in with a clear checkbox and a stored timestamp can satisfy that. Double opt-in is simply the cleanest evidence there is, because it rules out the "someone else entered my address" dispute entirely. In some markets the bar is higher in practice - German and Austrian case law has effectively made confirmed opt-in the standard there - so if you mail those audiences, treat it as required. Everywhere else it is a business decision, not a legal checkbox.
When single opt-in is the better choice
Skip double opt-in where the signup context already carries strong intent and identity: a customer ticking a newsletter box at checkout has just proven their email address by buying with it, and adding a confirmation step there mostly loses genuine subscribers. The same logic applies when you migrate a list of already-confirmed subscribers from another platform - making people confirm twice only shrinks the list. Single opt-in is also defensible for low-volume B2B lists where every signup is manually known to you.
When double opt-in clearly wins
Turn it on for public signup forms - popups, footers, landing pages - where anyone can type anything, for giveaways and lead magnets that attract freebie hunters and bots, for German and Austrian audiences, and whenever you are digging out of a deliverability hole and need the cleanest possible inflow while your reputation recovers.
How it works in MailingPlatform
You choose the scope. Each signup form has its own double opt-in toggle, so a public popup can require confirmation while a checkout opt-in stays single. Or enable it account-wide under Settings, GDPR, which also applies to subscribers created through the API - with a skip_confirmation flag for migrating contacts who already confirmed elsewhere. Until someone confirms, they sit in a pending state and never receive campaigns or automations; the status handling is automatic, and you can resend the confirmation to any pending subscriber with one click. CSV imports are deliberately exempt - double opt-in governs new signups, not lists you already own.
The confirmation email itself is yours to design. Build a template with the {{confirm_link}} merge tag as the button link, pick it under Settings, GDPR, and set a custom subject line. If a chosen template is missing the tag, the system falls back to the default design so the link always works. You also control how long confirmation links stay valid, from 1 to 30 days. The details live in the double opt-in help article.
What to do with the pending pile
Every double opt-in list accumulates pending subscribers who never clicked. Resist the temptation to "rescue" them by flipping them to active - that defeats the entire point and reintroduces exactly the addresses double opt-in filtered out. The right moves are smaller: resend the confirmation once, within a day or two of signup while the intent is still warm, and let the link expiry you configured clean up the rest. Watch your confirmation rate as a standing metric. If fewer than half of signups confirm, the problem is almost always the confirmation email's deliverability or clarity, not the audience - fix the email before questioning the policy.
Make the confirmation email earn its click
Most confirmation drop-off is a confirmation email problem, not a philosophy problem. Send it instantly - every minute of delay costs confirmations. Send it from your verified domain so it lands in the inbox at all. Keep it to one job: a clear subject ("Confirm your subscription"), one sentence of context, one unmistakable button. Do not bolt offers or product grids onto it - legally you are still pre-consent, and practically, every extra element competes with the only click that matters. Then let your welcome series do the selling the moment confirmation lands.
If you run a newsletter or a store list that you want to both grow and keep clean, double opt-in on public forms with single opt-in at checkout is the combination that fits most senders: friction exactly where junk enters, none where customers already proved themselves.