Forms · Glossary
What is double opt-in?
Double opt-in is a sign up process with two steps: a person submits their email address in a form, then confirms it, usually by clicking a link in a confirmation email. Only after that second step are they added to the list. It proves the address works and that its owner, not someone else, asked to join.
Double opt-in costs some sign ups and buys a cleaner list. It is good practice for email marketing, and in most places it is not a legal requirement in itself.
Indunil Asanka · Co-founder
4 min read · Published
| Method | Steps for the subscriber | What it proves | Typical effect |
|---|---|---|---|
| Single opt-in | Submit the form | Someone entered this address | More sign ups, more fake or mistyped addresses |
| Double opt-in | Submit, then click a confirmation link | The address owner agreed | Fewer but more engaged subscribers |
| Confirmed opt-in (soft) | Submit, receive a welcome email with an unsubscribe link | Little more than single opt-in | A middle ground some senders use |
How double opt-in works
The first step is the form: a field for the email address and, ideally, a consent statement and an unticked checkbox. The second step happens in the inbox: the service sends a message with a confirmation link, and the address is only added once the link is clicked. If nobody clicks, nothing is sent again. The record of the click, with its time, becomes the evidence that the owner of that address asked to be on the list.
What the law requires
Laws on marketing email mostly require consent, not a particular way of collecting it. Australia's Spam Act 2003 requires consent, express or inferred, before sending commercial electronic messages, and the ACMA's guidance stresses keeping records of that consent. In the UK and EU, consent must be freely given, specific, informed and unambiguous, and the sender must be able to demonstrate it, which double opt-in helps with. The US CAN-SPAM Act works mainly on opt-out, with rules on identification and unsubscribing. None of these laws names double opt-in as mandatory, though some regulators and courts treat it as strong evidence.
Why senders use it
A confirmed list has fewer typos, fewer addresses entered by bots or by someone else, and fewer spam complaints, which helps deliverability. It also deters people from signing up others as a prank. The cost is that some genuine subscribers never click the confirmation, often because the email landed in spam or was ignored, so a clear thank you page telling people to check their inbox matters.
Common mistakes
A pre-ticked consent box, which does not count as consent in the UK and EU. A confirmation email with a vague subject line that people delete. Sending marketing before the confirmation click. Losing the record of when and how consent was given. And treating double opt-in as a substitute for an easy unsubscribe, which every marketing email still needs.
Sign up forms in the product
A form built in OneCraft can collect the email and a consent checkbox, but no email goes to the respondent: the only form email is the owner's alert to one address. So the confirmation step of double opt-in has to happen in the email service the list lives in. A webhook can post each submission as JSON, once with no retry, to a system that sends the confirmation, and the thank you screen can tell people to watch for that email.
Questions people ask
Is double opt-in required by GDPR?
No. The GDPR requires consent for most marketing email and requires the sender to demonstrate it, but it does not prescribe double opt-in. Many organisations use it because a confirmation click is clear evidence that the address owner consented. Some national regulators and courts have treated it as the expected standard for proving consent.
Does double opt-in reduce sign ups?
Yes, some people never complete the second step. In exchange, the list contains people who actually want the emails, so open rates and deliverability are usually better. The loss shrinks when the thank you page says plainly that a confirmation email is on its way and to check spam folders.
What should a confirmation email say?
Who it is from, what the person signed up for, a single clear button to confirm, and a line saying that if they did not sign up they can ignore the message and will not be added. Keep it short and send it immediately, while the person is still expecting it.
Is double opt-in needed for customers who already bought from me?
Not usually. Several laws allow marketing to existing customers in some circumstances, such as inferred consent under the Spam Act or the soft opt-in under the UK rules, as long as an unsubscribe is offered. Double opt-in is most valuable for public sign up forms open to anyone.
Can a form send the confirmation email itself?
Some form tools can; many leave it to the email marketing service. The usual pattern is that the form passes the address to the email platform, which handles the confirmation and stores the consent record. That keeps the proof of consent with the list that uses it.
Make one with forms
The button opens the generator with this use case already described. Change the wording to match your own.
Create a form with OneCraftRelated questions
- What is a consent checkbox?What is a consent checkbox? A box a person ticks to agree to one specific use, such as marketing email. Why it starts unticked, with AU, EU and US rules.
- What is a lead capture form?What is a lead capture form? A form that collects a prospect's details plus a few qualifying answers so sales can follow up well. Lead form vs contact form.
- What is a thank you page and what should it say?What is a thank you page? The screen after a form is sent. What it must confirm, when a redirect or an email confirmation does the job better.
Step by step in the builder: Automate your form with add-ons.
Written and checked by the OneCraft team. Last checked .