Sending newsletters in the EU requires consent – and the ability to prove it. Double opt-in is the established way to do both. This guide explains the legal basis, the process and what to log. It is not legal advice, but it shows what matters in practice, using Germany's strict rules as the reference.
The legal basis
- German Unfair Competition Act (§ 7(2) no. 2 UWG): email advertising without prior express consent is an unreasonable nuisance and can be enforced by competitors and consumer associations.
- Art. 6(1)(a) and Art. 7(1) GDPR: processing based on consent requires that you can demonstrate it. The burden of proof is yours.
- Art. 7(3) GDPR: withdrawing consent must be as easy as giving it – one click in every email.
An exception (§ 7(3) UWG, based on the ePrivacy Directive) covers existing customers: if you obtained the address in connection with a sale, you may advertise your own similar products, provided the customer has not objected and is informed of the right to object at collection and in every email. The conditions are narrow; consent is the safer route.
Why “double”?
With single opt-in someone types an address into a form – but was it really the owner? Only clicking a link sent to exactly that address shows that the person controls the mailbox and wants the newsletter. Without that confirmation you can hardly prove the consent came from the right person.
The process in four steps
- Signup form: the email address as the only required field, an unticked checkbox with clear wording: who writes, about what, how often, and that consent can be withdrawn at any time. Link to your privacy policy.
- Confirmation email: immediate, factual, no advertising – just the request to confirm and the link.
- Confirmation: the click activates the subscription. Only now may the newsletter be sent.
- Log: signup and confirmation are stored with timestamps.
What to log
- time of signup and confirmation,
- the source (which form or page, imports with origin),
- the consent wording as displayed,
- an IP address – truncated is usually sufficient as evidence and more privacy-friendly,
- every later unsubscribe and topic change.
Keep the record as long as claims can be raised. In Germany the standard limitation period is three years from the end of the year.
Common mistakes
- Pre-ticked boxes are not valid consent.
- Bundling: making newsletter consent a condition for a download or prize draw can violate Art. 7(4) GDPR.
- Confirming on GET: corporate security scanners open links automatically. If opening counts as confirmation, machines “confirm”. Better: the link leads to a page with a confirm button.
- Keeping unconfirmed addresses: delete signups not confirmed within a few days.
- Bought lists: there is no valid consent for them – and they ruin deliverability.
Unsubscribing must be easy
Every email needs a working unsubscribe link. Gmail and Yahoo additionally require bulk senders to support one-click unsubscribe via the List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058), honored within two days.