Last reviewed:
Translated from German; if the versions differ, the German version applies.
Not legal advice: Legal content on this page appears only as verbatim quotations from statutes, court rulings or authority papers, with their source; quotations from German texts are our working translations. We do not assess them ourselves, and no lawyer has reviewed this page. It is no substitute for legal advice in your individual case.
Double opt-in
In short: Double opt-in (DOI) is a sign-up procedure in two steps: anyone who enters an email address in a form first receives a confirmation email with a link. Only after clicking this link is the address added to the list.
The steps
- Entry: A person enters their address in a sign-up form and submits it.
- Confirmation email: The sending platform sends a message with a personal confirmation link to exactly this address. Until then, the address is only noted as pending.
- Click: If the person clicks the link, the system sets the address to “confirmed”. If they do not click, the address stays out.
The idea behind it: only someone with access to the mailbox can click the link. This makes it much harder for someone to enter another person’s address so that its owner receives newsletters without having asked for them. The sending platform can record the time of each step.
What authorities and courts write
Quotations from German court rulings and authority papers are our working translations; only the German wording is authoritative (see the German version of this page).
The term “double opt-in” does not appear in the wording of Section 7 of the UWG (the German Act against Unfair Competition, Gesetz gegen den unlauteren Wettbewerb) or of the GDPR. The German data protection authorities (Datenschutzkonferenz, DSK) write in their guidance:
“For consent declared electronically, the double opt-in procedure is required to verify the declaration of intent of the data subject, whereby the BGH’s requirements of proof under the UWG (judgment of 10 February 2011 - I ZR 164/09) are to be taken into account in the logging.” (our translation) — DSK guidance on direct marketing (February 2022), section 3.3, p. 11
On confirmations by text message or telephone, the same section says: “With regard to double opt-in procedures that use confirmation codes transmitted by SMS or by telephone call, or confirmations obtained in this way, it should be pointed out that, owing to the ease of forgery, the evidential value of such procedures is as a rule to be regarded as low.” (section 3.3, p. 12, our translation)
Germany’s Federal Court of Justice (Bundesgerichtshof, BGH) dealt with the procedure in the judgment mentioned, a case concerning telephone advertising. The reasons state: “If an application to take part is received electronically, its sender can be asked by email to confirm their wish to take part. Once the requested confirmation has been received, it can be assumed that the application actually came from the email address given.” (BGH, judgment of 10 February 2011, I ZR 164/09, para. 37, our translation) Headnote 3 reads: “A confirmation email in the electronic double opt-in procedure neither proves the consumer’s consent to advertising calls nor, on its own, leads to an easing of the burden of proof in favour of the advertiser.” (our translation)
Whether and how these statements apply to a particular newsletter is not something we assess. All wordings in context: Consent and double opt-in.
How it differs
- Single opt-in: Sign-up in one step, without confirmation. Whether the address belongs to the person who filled in the form is not checked (Single opt-in).
- Opt-out: The opposite model, in which someone is written to until they object (Opt-out).
- Consent: Double opt-in is a procedure, consent is a term of the GDPR (Art. 4(11)). The two are not the same.
Easily confused
- Confirmation email and welcome email: The confirmation email comes before the address is added to the list and contains the link. The welcome email comes afterwards.
- “Double opt-out”: The authorities use this expression for something else, namely for confirming a withdrawal of consent via the known email address (guidance, section 3.7, p. 14). More under Opt-out.
- Spellings: Double opt-in, double-opt-in and the abbreviation DOI mean the same procedure; the German authorities and the BGH each use their own German spelling (see the German version of this page).
Example
This is what the path of a sign-up typically looks like in the data of a sending platform (simplified, example address):
| Time | Step | Status of the address anna@example.de |
|---|---|---|
| 10:02:14 | form submitted | pending |
| 10:02:15 | confirmation email sent | pending |
| 10:17:40 | confirmation link clicked | confirmed |
If the click does not happen, the address is not added. The actual checkpoint lies between the second and the third step: only someone who can open the mailbox gets to the link.
Frequently asked questions
What is the double opt-in procedure? A sign-up in two steps: entry in the form, then a click on a confirmation link in an email to the address entered.
Is double opt-in mandatory? Section 7 UWG and the GDPR do not name the procedure. The German data protection authorities write that it is “required” for consent declared electronically (guidance on direct marketing, section 3.3, our translation). We give no legal assessment for your case.
What does double opt-in mean literally? Roughly “opting in twice”: the person signs up once in the form and confirms a second time by clicking in the email.
Related terms
Matching tool
- Selection checklist for a sending platform: questions for providers, including on double opt-in and logging.