What is double opt-in, and does your newsletter need it?

What does double opt-in do?#

1. Somebody types their address into your form and submits it.
2. Your sending tool emails that address with one link and no marketing.
3. Nothing further goes out unless that link is clicked.
4. The unconfirmed address sits apart, and usually expires instead of joining the list.

Single opt-in skips step two and three: the submission is the subscription. Most forms on the internet are single opt-in, which is why so many lists contain addresses nobody chose.

What is the difference between double opt-in, single opt-in and soft opt-in?#

They answer the same question, which is what proof you hold that a person wanted your mail. The four common answers are not equally strong, and the difference only shows up when somebody disputes it.

Do I need double opt-in by law?#

Not in the United States. The FTC describes the CAN-SPAM rules as obligations about what a commercial message must contain and how fast you honour an opt-out, and the guide does not require permission before mailing a consumer. The list of what you do owe is at the CAN-SPAM rules for a small business newsletter.

Elsewhere the question changes shape. Under the EU GDPR, Article 7 says that where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented. That is an evidence duty, and a confirmation click that carries a timestamp is a record. A name typed into a form by an anonymous script is not.

Why do people warn that the list gets smaller?#

Because it does. Some share of people who submit a form never open the confirmation email, do not recognise it, or were never serious about subscribing in the first place. Every one of those is a loss you feel in a dashboard and no reader ever notices.

The trade is the point. A list of 800 confirmed addresses sends more bookings than a list of 1,300 where 500 never intended to be there, and the second list also drags your placement down every time you mail it.

What does double opt-in protect against?#

• Bots submitting a form over and over with real addresses belonging to other people.
• A rival filling your form with somebody else's address so that they get unexpected mail.
• Typos, since a mistyped address never confirms.
• Addresses harvested from an old spreadsheet by whoever imported them.

The second one is not paranoia. A confirmation email sent to a stranger who never asked is exactly the message that gets reported as spam, and the complaint lands on your domain rather than on the person who typed your form.

What should the confirmation email say?#

It is one message with one job, and the reliable way to wreck it is to put an offer in it.

• Say who is sending it, in the words your own customers use for you.
• Repeat what they asked for, because "confirm your account" means nothing next to "here is the monthly note of what is on the menu".
• One link, and no second request competing with it.
• Tell them what happens if they ignore it. The answer should be that nothing ever arrives.
• Your postal address and a way to leave, exactly as in any other email you send.

Why did my confirmation email never arrive?#

Because the confirmation stage fails more often than the willingness stage, this is worth checking before you conclude that your readers are flaky.

• It went to spam. Mail from a domain the reader has never heard of, to an address that has never mailed you, is precisely what a filter is built to be cautious about.
• A company mailbox quarantines the first message from an unknown sender, and nobody in their IT department ever looks at the queue.
• The address was typed wrong, so the message went to somebody else or nowhere at all.
• The provider held it while it formed a view of you, which can be minutes and sometimes hours.

The first cause is the common one, and it is the annoying one, because a confirmation email is already plain: no images, one link, no promotional language. If yours is not arriving, check how the message is signed and what domain it comes from before you blame the reader. The signature problem has its own guide at SPF, DKIM and DMARC explained.

How much does double opt-in cost in signups?#

Everybody wants a percentage and no honest one exists, because the number depends on your form, your audience, and whether your confirmation mail arrives at all. What you can do is measure your own gap once and stop guessing.

If the gap looks wide, fix the confirmation email before you decide whether the practice is worth it. A large part of what people blame on double opt-in is usually a message that never arrived or never explained itself.

When is single opt-in the better choice?#

When the confirmation email itself is the thing you are being judged on. A club taking sign-ups at a table, a shop collecting addresses in person, or a class filling ten seats this week all lose people in the gap between the form and the click. If the join is face to face and you can see the person, the evidence you need is already in the room.

If you go that way, keep a record of where and when each address was taken, because that is the thing an evidence duty asks for.

What do I do with a list I already have?#

You do not mail it as though it had asked. Addresses collected at a counter, from a competition entry, or out of a spreadsheet someone kept for three years have never seen a confirmation. The careful path is one honest email that says who you are, why that address is on your file, and asks for the click that keeps them on it, then mail only the people who answer.

Does confirming help my deliverability?#

It helps by removing the people who hurt you. Mailboxes score senders on complaints and on whether readers open anything, and a confirmed list is a group of readers who have already said yes twice. What confirmation does not do is fix a signature problem, a shared sending address, or a domain with nothing but strangers on its list. Those are separate, and they are at why is my email going to spam.

How do I add double opt-in to a list I already have?#

1. Switch the setting on for new signups first. That half costs nothing and stops the problem growing.
2. Leave the addresses you already hold where they are rather than importing and re-confirming in one move.
3. Send one honest email to the inherited list: who you are, where their address came from, and one link that keeps them on it.
4. Mail only the people who click, and treat silence as a no rather than as a maybe.
5. Keep both records, the original source and the new click, because the second one is the answer to any later dispute.

What does this look like on a website form?#

A form that says what the reader will get is doing half of the confirmation work for you. "Subscribe" tells them nothing, and "Get the monthly list of what is on the menu" tells them what they are about to agree to, which is the difference between a click and a complaint.

• One line under the button naming the thing they will receive and roughly how often.
• No pre-ticked box. A box somebody else ticked is not a yes, and it is the pattern a regulator singles out.
• Your privacy note next to the button rather than behind it, so the reader is not hunting for who else sees this.
• The confirmation email that repeats the same promise, in the same words.

The last one is where most of the lost clicks come back. A reader who confirms because the email names the exact thing they wanted is not a reader who confirmed by accident, and the second sort unsubscribes from the first real campaign.

Common questions