Double opt-in, simply explained – so your newsletter stands on solid ground

What double opt-in means

“Opt-in” roughly means “actively choosing to take part.” With a single opt-in, someone enters their address and is on the list right away. Double opt-in adds a second step: the address entered receives an email with a confirmation link. Only those who click it are subscribed.

The idea behind it is simple. Anyone can type any address into a form – by accident with a typo, or deliberately using someone else’s address. The click in the confirmation email shows that the person has access to that inbox and really wants to sign up.

Why it matters for email marketing

Under Section 7(2) No. 2 of the German Unfair Competition Act (UWG), advertising by electronic mail without prior express consent is an unreasonable nuisance. A newsletter with offers is advertising. So you need consent before you send it.

The General Data Protection Regulation adds to this: under Art. 7(1) GDPR, the controller must be able to demonstrate that the person has consented. The burden of proof is therefore on you as the sender, not on the person receiving your email. Double opt-in isn’t expressly required by any law – but it’s the common way to provide this proof.

Section 7(3) UWG sets out an exception: if you received the email address from your customer in connection with the sale of goods or a service, you may, under strict conditions, advertise your own similar products – provided she hasn’t objected and is clearly informed of her right to object when the address is collected and in every email. This exception does not apply to a general newsletter sent to new prospects.

What Germany’s Federal Court of Justice has said

In its ruling of February 10, 2011 (case no. I ZR 164/09, “Double-opt-in-Verfahren”), the Federal Court of Justice (BGH) addressed the process. It ruled that a confirmed email address does not prove consent to promotional phone calls – so the process isn’t sufficient for telephone marketing. For email marketing, on the other hand, the court considered double opt-in a suitable process. What remains important: the advertiser must fully document the consent.

A second ruling concerns the content of automated emails: on December 15, 2015 (case no. VI ZR 134/15), the Federal Court of Justice ruled that advertising in an automated confirmation of receipt can be unlawful if the recipient has expressly objected to advertising. In practice, this means: keep the double opt-in confirmation email factual and free of advertising.

How a clean double opt-in works

From the form to the first newsletter, there are five steps:

1. Sign-up form: the person enters their email address. The consent checkbox isn’t pre-checked, and the text names the sender, the content and the approximate frequency, and points to the right to withdraw and to the privacy policy.
2. Confirmation email: a factual email goes out to the address immediately – with a “Confirm subscription” link and no advertising.
3. Click: the subscription only takes effect once the link is clicked. Unconfirmed addresses don’t receive a newsletter.
4. Record: you log the time of sign-up, the time of confirmation, the exact consent text and the source (for example, which form).
5. Newsletter: every issue contains an unsubscribe link that makes unsubscribing just as easy as subscribing.

What belongs in the proof

The Federal Commissioner for Data Protection and Freedom of Information (BfDI) points out that consent must be fully documented. In practice, this list has proven itself:

• Email address and time of sign-up
• Exact wording of the consent text the person saw (with version or date)
• Where the sign-up took place, such as which page or which form
• Time the confirmation email was sent
• Time of the confirmation click
• Later withdrawal: when and by what means

Example: what the confirmation email can look like

The confirmation email is short, friendly and contains only what belongs to the sign-up. An example for a bakery:

Subject: “Please confirm your subscription to the Müller Bakery newsletter.” Text: “Hi, you’ve just signed up for our newsletter – about once a month with new cakes, specials and dates. Please confirm your subscription with one click on the button. If you didn’t sign up, simply ignore this email – then you won’t hear from us.” Below that, the “Confirm subscription” button, the legal notice (Impressum) and a link to the privacy policy.

Typical pitfalls are a pre-checked box in the form, a voucher or offer right in the confirmation email, and newsletter consent that’s tied to something else, such as a giveaway or a download. Keep these things neatly separate.

Easy to unsubscribe – just as important as signing up

Under Art. 7(3) GDPR, consent can be withdrawn at any time, and withdrawing must be as easy as giving it. For newsletters, the BfDI stresses that unsubscribing must not be more complicated than subscribing. One click on an unsubscribe link in every email does this best – no login, no reason, no detours.

A final note: this guide explains the basics and is not a substitute for legal advice. If you’re unsure how this applies to your business, ask a lawyer or your chamber of commerce or crafts.