Does GDPR require double opt-in?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
No, GDPR doesn't explicitly require double opt-in. But there's a meaningful gap between what's technically required and what's actually smart.
GDPR requires valid consent and the ability to demonstrate it. It doesn't specify the mechanism. Single opt-in with proper documentation, a timestamped record of when someone checked an unchecked box, could technically satisfy GDPR's consent requirements. The regulation cares about the fact of consent, not the confirmation email.
That said, double opt-in creates significantly stronger evidence. The confirmation click proves three things at once: the email address is real and accessible, the person who controls it actively confirmed intent, and you have a timestamped record of both the original signup and the confirmation. If consent is ever challenged, that's a much easier position to defend.
Regulators haven't issued binding guidance making DOI mandatory, but enforcement patterns suggest preference for it as best practice. When fines can reach €20 million, the friction of a confirmation email looks like excellent risk insurance.
The practical answer: if you have EU subscribers, treat DOI as your default. It improves your consent records, filters out typos and bot signups, and gives you a cleaner list to start with. The short-term list growth hit is worth it.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
