What is “confirmed opt-in” (COI)?

Confirmed opt-in (COI) is simply another name for double opt-in. The two terms mean the same thing. The word "confirmed" just puts the focus on what actually matters: the subscriber actively verified that they own the address and want your emails.

Here's how it works. Someone fills out your signup form. You send them a confirmation email with a single click-to-verify link. They click it. Only then do they join your list. That click is the confirmation step that gives COI its name.

From a deliverability standpoint, COI is genuinely worth it. Because every address on your list has been verified, you get fewer hard bounces, fewer spam complaints, and stronger overall engagement. Spam filters notice that. Yes, your list will grow more slowly than with single opt-in. But the subscribers you do get actually wanted to be there, and that shows in the metrics.

From a legal standpoint, COI gives you documented proof of consent. That matters under regulations like GDPR, where you may need to demonstrate that someone deliberately opted in. What you want to store for each subscriber: the date and time of signup, the IP address used, the exact wording of the consent checkbox or signup form at that moment, the date and time the confirmation link was clicked, and which version of your signup form was live at the time. Store this somewhere you can actually retrieve it, not just in your ESP's backend (which you don't control if you switch platforms).

Spamhaus and M3AAWG both recommend COI as the cleanest way to build a list. It's not just about legal cover. It's about sending to people who actually remember signing up.

If you're thinking about how long that consent stays valid before you need to re-engage or re-confirm, that's a different question worth exploring on its own.