Is DOI required by any laws?

Short answer: no law explicitly writes "you must use double opt-in" into its text. But several jurisdictions have consent standards that make double opt-in the safest practical choice.

Germany is the clearest example. German courts have consistently ruled that senders must prove consent if challenged, and DOI provides the most reliable evidence trail. The legal requirement isn't "use DOI." It's "be able to prove consent." DOI is just the cleanest way to do that. Sending to German subscribers without verifiable proof opens you to legal challenges and potential injunctions.

GDPR takes a similar approach. It doesn't name DOI specifically, but it requires that consent be demonstrable. A single opt-in signup can satisfy this if you keep detailed logs (IP address, timestamp, form version), but those records are harder to defend than a confirmation click from the actual inbox owner. DOI's verification step proves the email address belongs to the person who consented.

CASL in Canada requires express consent for commercial messages. DOI isn't mandatory, but it's strongly recommended. CAN-SPAM in the US doesn't require prior consent at all. You just have to honor opt-outs.

In practice, most sophisticated email programs use DOI regardless of legal minimums. It keeps spam complaints down, keeps your list clean, and gives you a defensible record if anyone ever asks. If you want to check how your current consent records hold up, our SOS line at reviewmyemails.com/sos is a good starting point. See also consent proof requirements.