What is double opt-in?

Double opt-in is a two-step way of signing people up to your email list. First, someone enters their email address on your form. Then you send them an automatic confirmation email with a link, and they are only added to your marketing list once they click it. The second step proves the address is real, belongs to the person who signed up, and that they really want to hear from you.

The alternative is single opt-in: the person fills in the form and is added straight away, with no confirmation. Single opt-in grows a list faster; double opt-in grows a cleaner one.

Why double opt-in matters for a small business

• Fewer fake and mistyped addresses. Typos such as “gmial.com” and bots filling in forms never make it onto your list.
• Better delivery. Sending to addresses that bounce or never engage can hurt how inbox providers treat your emails. A confirmed list avoids much of that.
• More engaged readers. People who confirm are showing real interest, which tends to show up in opens and clicks.
• Proof of consent. A record of who confirmed, and when, is strong evidence that someone asked to hear from you.
• Protection from abuse. Nobody can sign up someone else’s address without that person knowing.

How double opt-in works: an example

Lerato runs an online plant shop in Durban and offers a free plant-care guide in exchange for an email address.

1. A visitor enters their name and email on the signup form and ticks a clear box agreeing to receive marketing emails.
2. The page says: “Almost there. Check your inbox and click the link to confirm.”
3. An email arrives within a minute: “Please confirm your subscription to get your plant-care guide”, with one big button.
4. When they click, they are marked as subscribed, the date and source are recorded, and the guide is sent.
5. Anyone who never clicks is not added to her marketing list.

Her list grows a little more slowly than before, but far fewer emails bounce and many more people open her newsletters.

Is double opt-in required by law?

In most places the law asks for consent, and for you to be able to show it, rather than naming double opt-in as such. But the details differ:

• United States: the CAN-SPAM Act works on an opt-out basis: you must include a working unsubscribe option and a postal address, and honour opt-outs within 10 business days. See the FTC’s compliance guide.
• United Kingdom: you generally need someone’s specific consent before sending them marketing emails, with a limited exception for existing customers. See the ICO’s guidance.
• Canada: Canada’s anti-spam law requires express or implied consent, and it is up to the sender to prove it. See the Government of Canada’s guidance.

Double opt-in is one of the clearest ways to show that consent was given. This is general information, not legal advice: check the rules in the countries where your subscribers live.

Best practices and common mistakes

• Tell people what happens next on the thank-you page, so they look for the email.
• Check the confirmation email reaches the inbox, not the spam folder, by testing with a few of your own addresses.
• Send one reminder to people who have not confirmed after a day or two, then stop.
• Record the source and date of each consent, so you can answer the question “how did I get on your list?” if a subscriber ever asks.
• Keep the form short. Name and email are usually enough. Every extra field loses some sign-ups before they even reach the confirmation step.
• Do not pre-tick consent boxes. Consent should be an action the person takes.
• Make leaving as easy as joining, with an unsubscribe link in every email.

Related terms

Email marketing is what you do with the list once people have opted in. A lead magnet is the free guide or offer that gives people a reason to sign up. Email open rate is one of the numbers a confirmed list tends to improve. For more on building a list the right way, read how to grow an email list from zero.

Email consent in startbuddi

In startbuddi, the focus is on recording consent clearly: there is no built-in confirmation-email step today. Every contact has a marketing status (Subscribed, Not subscribed, Transactional only or Suppressed), along with the consent source and consent date. In Forms, you can add a consent block, or mark a checkbox as counting as marketing consent, so signups arrive with their permission recorded.

When you send a campaign from Marketing, unsubscribed, bounced and suppressed contacts are skipped automatically, and every email carries an unsubscribe link, your business address and a preferences link. The Marketing module needs a paid plan, from Starter. Your next step: check that every signup form on your site has a clear, unticked consent box.