Double opt-in: what the law requires.
No German law literally prescribes double opt-in, and yet hardly any newsletter goes without it. This guide explains why: what you have to be able to prove about consent, what belongs in the record and what changes when subscribers confirm by sending an email instead of clicking a link.
- Why double opt-in is standard
- What to document
- Confirmation by sent email
Christian Schätzlein, Founder and developer of Sendity
3 min read
What a consent record contains
Double opt-in record (example)
-
Sign-up Date, time, source page Step 1
When and where the person signed up.
-
Wording Consent text in that version Step 1
What exactly the person agreed to.
-
Confirmation Date and time of the click or message Step 2
Proves that the inbox owner confirmed.
-
Withdrawal Unsubscribe link in every email Always
Consent can be withdrawn at any time.
Sign-ups by message. No form, no code.
Sendity is a sign-up widget for your website. Instead of filling in a form, your visitors send one short message via WhatsApp or email. Sendity checks who it came from and hands your site the name and the confirmed phone number or email address.
See how Sendity works →-
One message instead of a form Visitors tap send in WhatsApp or their email app. Nothing to type, no confirmation email to click.
-
Confirmed by the message itself The contact comes from the sender of the message, so typos and made-up addresses never reach your list.
-
Pay per confirmed contact Start with 1,000 free credits, no credit card. After that, prepaid packages with no subscription.
Two rules meet: advertising by email needs consent, and you have to be able to prove that consent.
Consent for email advertising
Under the German Unfair Competition Act (UWG), advertising by email without prior express consent is an unreasonable nuisance. A newsletter counts as advertising.
Proof of consent
Article 7(1) GDPR requires you to be able to demonstrate consent. A typed address alone proves nothing: anyone can type anyone’s address.
What the courts accept
The Federal Court of Justice accepted double opt-in as suitable proof of email consent (judgment of 10 February 2011, I ZR 164/09). The same judgment found it insufficient for consent to phone calls.
What to keep
Time of sign-up and confirmation, the wording of the consent in the version shown, and the way the person confirmed. Keep it as long as you use the consent.
Confirmation by sent email
With reverse OTP, the subscriber sends an email from their own inbox, signed by their provider (DKIM), with time and code. Whether that replaces the confirmation link in your case is a question for your legal advisor.
A consent record in three steps.
What a complete record contains.
Record the sign-up
Time, page and the consent text in its current version.
Record the confirmation
Time and way of confirmation: clicked link or sent email.
Offer withdrawal
An unsubscribe link in every email, and honour it right away.
Confirmation link or sent email?
What each record shows.
| Aspect | Confirmation link | With Sendity |
|---|---|---|
| Who acted | Someone clicked the link | The inbox sent an email |
| Automatic clicks | Security scanners can click links | Scanners do not send emails |
| Evidence | Server log of the click | Signed email with time and code |
| Legal recognition | Established case law | To be assessed case by case |
This guide is general information, not legal advice. Please check your specific case with your legal or data protection advisor.
What a sent email adds.
Independent of the legal assessment, the record gets stronger.
An action, not a click
Sending an email is something a person does on purpose.
Signed by the provider
DKIM shows the email really came from that inbox.
Time and code
The record links the email to exactly this sign-up.
Live on your page in minutes.
Sendity runs as a compact widget on your page. Pick the path that fits your website.
Double opt-in and the law: common questions.
Is double opt-in mandatory?
Not by name. But without it, you can hardly prove consent to email advertising, so in practice it is the standard.
Is the confirmation email itself advertising?
It should contain nothing but the request to confirm. Courts have ruled differently on this; keep it strictly factual.
Does this also apply to WhatsApp newsletters?
Advertising via WhatsApp or SMS also needs prior express consent. A verification alone is not consent to advertising.
How long do I keep the record?
As long as you use the consent, and beyond that as long as you might have to prove it. Your advisor will name a period.
Keep reading.
Reviewed for accuracy in by Christian Schätzlein.
Consent confirmed by a sent email.
Try the live demo on your phone. It takes ten seconds.