Which countries require double opt-in for email marketing according to GDPR and best practices?
Published 10 Jul 2025
Updated 25 Oct 2026
16 min read
Summarize with
Updated on 25 Oct 2026: We clarified country-specific double opt-in requirements and updated the guidance on B2B consent.
GDPR itself does not require double opt-in in any country. When processing relies on consent, that consent must be freely given, specific, informed and unambiguous, and the controller must be able to demonstrate it. Neither GDPR nor UK GDPR prescribes a confirmation-link workflow. GDPR Article 7 sets out the conditions for consent and the obligation to demonstrate it.
Operationally, double opt-in, confirmed opt-in, COI, and DOI usually mean the same workflow: the person submits an address, receives a confirmation email, and must click a link before the address becomes mailable for marketing.
That matters even when the sender is outside Europe. GDPR can apply when an overseas sender's processing relates to offering goods or services to people in the EEA or monitoring their behaviour there. UK GDPR uses an equivalent test for people in the UK. An overseas marketing program should therefore assess its audience and processing activity, not rely only on the sender's location.
For German email marketing based on electronic consent, use double opt-in by default. Germany's consent-proof requirements and regulator guidance make it the standard process to build around. A bare form submission gives weaker evidence if the recipient disputes signing up. This is different from a GDPR provision naming double opt-in or a rule covering every existing-customer email.
Austria, Greece, Italy, Luxembourg, Norway and Switzerland are often included in double opt-in policies, but their legal positions differ. Italy's Garante has described double opt-in records as a minimum protective measure in its enforcement decisions. Denmark, Finland and the Netherlands also fit a conservative policy for public forms or weak consent records. These recommendations are not a shared statutory mandate. Switzerland is outside the EU and EEA, so its local marketing rules need a separate assessment.
Double opt-in requirements and recommendations by country
Separate national law and regulator guidance from your recommended signup policy. The table identifies those differences; its default column is a practical recommendation for new marketing subscriptions, not a claim that every listed country legally requires a confirmation click.
|
|
|
|---|---|---|
Germany | Use double opt-in for consent-based signups | |
Austria | Prefer double opt-in for public forms | |
Denmark | Conservative policy recommendation | Prefer double opt-in for public forms |
Finland | Conservative policy recommendation | Prefer double opt-in for public forms |
Greece | Use double opt-in for public signups | |
Italy | Use double opt-in for public signups | |
Luxembourg | Conservative policy recommendation | Prefer double opt-in for public forms |
Netherlands | Conservative policy recommendation | Prefer double opt-in for public forms |
Norway | Use double opt-in to document consent | |
Switzerland | Prefer double opt-in for consent evidence | |
UK | PECR does not prescribe a double opt-in method | Prove consent or document an exception |
United States | No federal double opt-in mandate under CAN-SPAM | Permission-based signup recommended |
Canada | Express or qualifying implied consent under CASL | Double opt-in useful for express consent evidence |
Recommended policies assume the signup has a lawful basis; valid local exceptions still need supporting records.
For Germany, require double opt-in for routine online marketing signups that rely on consent. For the other European markets listed above, it is a sensible default when a public form cannot verify who entered an address. Any alternative process must meet the applicable national requirements and produce reliable evidence; a logged-in session alone does not settle that question.
Do not read absence from the table as permission for loose consent. Consumer email marketing in France, Spain, Ireland and Belgium generally needs prior consent or an applicable customer exception, with clear unsubscribe handling and records strong enough to answer a complaint. B2B rules need a separate check.
For Canada, CASL guidance requires express consent or a qualifying implied-consent basis unless an exemption applies. Double opt-in is a useful proof method, rather than the only lawful route. Keep the consent evidence, sender identification and unsubscribe mechanism, and record any expiry of the implied-consent basis.
A conservative working policy should keep two points separate: GDPR does not name double opt-in, but local direct marketing rules, regulator guidance, ESP policies, and dispute risk can still make confirmed opt-in the safer operating default in specific markets.
Two regulator examples explain why a single country label is insufficient. Greece's Directive 2/2011 requires procedures to verify electronic consent and mailbox access, with double opt-in as one specified route. In Italy, the Garante's 18 June 2026 decision found promotional emails unlawful where the recipient had not completed the advertised account-confirmation process and the claimed signup was disputed. Neither example creates a GDPR-wide confirmation-click rule.
Infographic showing country risk for double opt-in email marketing under GDPR and deliverability best practices.
How GDPR and national marketing rules fit together
GDPR and direct marketing law answer different parts of the same workflow. GDPR governs how an email address and related consent data are collected, used, stored and deleted. Article 13 of the ePrivacy Directive sets the prior-consent framework for electronic direct marketing to individual subscribers, with a limited existing-customer exception. National implementations determine the detailed sending rules, including treatment of business recipients. Legitimate interests under GDPR do not override a national requirement for prior marketing consent.
Prior consent means permission must exist before the marketing message is sent. It does not automatically mean double opt-in. An affirmative selection of a clearly worded, initially unchecked box can record consent in one step, while a confirmation click adds evidence of access to the mailbox. That evidence is why German electronic-consent signups and other markets with specific verification expectations need closer attention.
The existing-customer exception is often called soft opt-in. In general, it covers an address collected during a sale, or qualifying negotiations in some national implementations, when the sender markets its own similar products or services and offers a free, easy objection at collection and in every message. It does not turn a purchased list, public address, or unrelated partner lead into a lawful audience.
Choose the rule before the signup flow
Record which national sending rule applies, whether the program relies on consent or a documented exception, and what evidence will answer a complaint. Double opt-in strengthens consent evidence, but it does not create a soft opt-in or repair an invalid legal basis.
Why Germany usually needs double opt-in
Germany gets singled out because the sender must prove the consent it relies on. For online newsletter signups, double opt-in is the standard process for documenting access to the subscribed mailbox. This does not mean every German marketing email needs a new confirmation: a valid existing-customer exception or independently documented consent requires its own assessment.
The German DSK direct marketing guidance calls for double opt-in to verify electronic consent and says saving an IP address alone is insufficient. Keep the exact consent wording and the confirmation record tied to the address used for marketing.
German UWG rules also include a narrow existing-customer path for similar products or services. The sender must have obtained the address in connection with selling a product or service, use it to advertise its own similar offerings, and respect any objection. The customer must receive clear notice of the right to object at collection and in every message, without costs beyond basic transmission charges.
A single opt-in form can capture a timestamp, IP address, form URL, consent text and user agent. That helps, but it does not prove that the person who submitted the form controlled the email address. A typo or third-party submission can put someone else's address into the form. Confirmed opt-in adds evidence of mailbox access when the confirmation record is tied to the signup; it does not establish the subscriber's legal identity.
Single opt-in
- The subscriber joins the list immediately after form submission.
- The record proves a form was submitted, not that the inbox owner submitted it.
- Typos and hostile signups can produce complaints and spam reports.
Double opt-in
- Some valid subscribers never click the confirmation email.
- The record connects the subscription to confirmation through the supplied mailbox.
- Invalid, mistyped, and weaponized signups usually never confirm.
For German electronic-consent signups, build around double opt-in and complete consent records. Document any different lawful route before sending, including the conditions of an existing-customer exception.
What GDPR really asks you to prove
When processing relies on consent, Article 7 requires the controller to demonstrate that consent. Recital 32 explains why silence, inactivity and pre-ticked boxes are not consent. Double opt-in helps, but a confirmation click still needs clear consent wording and a record of the permission given. The privacy information must be available when the address is collected.
For checkout, registration, and lead capture forms, the marketing checkbox should start unchecked. A purchase address or account address can support transactional messages, but it should not be quietly turned into newsletter consent. Confirmed opt-in also does not make consent portable across unrelated brands, list rentals, or broad partner sharing; keep the consent purpose tied to the sender and message type shown at signup. Do not make optional marketing consent a condition of purchasing a product or creating an account when it is unnecessary for that service.
- Store the exact wording shown near the checkbox or subscribe button.
- Do not rely on pre-ticked boxes, silence, or inactivity as the consent action.
- Record the sender, message type, frequency promise, page, campaign, language, and list the person joined.
- Capture the click timestamp and token used to confirm the address.
- Collect only the fields needed for subscription, consent proof, personalization, and suppression.
- Set a retention period for unconfirmed signups and old consent records.
- Make consent withdrawal clear, online, and no harder than the signup flow.
- Keep opt-outs durable so a new import does not re-add people.
For GDPR programs, keep the consent store narrow: collect enough to prove permission and suppression, then protect it with normal access controls. A confirmation record becomes less useful if it is stale or disconnected from the actual subscription state. When handling an erasure request, remove unnecessary marketing data and assess any separately justified retention of minimal suppression records. The ICO's suppression guidance explains why keeping enough information to prevent renewed marketing can protect an unsubscribe request.
Consent proof and unsubscribe proof belong together. If signup takes one web action and a confirmation click, withdrawal should be online, obvious, and at least as easy. A preference center can offer opt-down choices, but it should not block a full unsubscribe with login, a required survey, or extra identity checks.
For U.S. campaigns, CAN-SPAM does not impose a general prior opt-in requirement. The FTC's CAN-SPAM guidance permits a return email address or another easy Internet-based opt-out, available for at least 30 days after sending and honored within 10 business days. Do not require login, fees, a survey or identifying information beyond an email address to opt out. Applicable mailbox-provider one-click unsubscribe requirements are separate from this legal minimum.
Consent event fieldsjson
{ "email": "person@example.com", "source": "newsletter_form", "country": "DE", "consent_text_id": "newsletter-v4-en", "form_submitted_at": "2026-05-17T09:14:22Z", "confirmed_at": "2026-05-17T09:16:03Z", "confirmation_token_id": "tok_4b7a9", "privacy_notice_version": "2026-04-01", "ip_country": "DE", "list": "weekly_newsletter" }
Double opt-in does not fix vague consent
If the form says "Submit" and hides marketing permission in a privacy policy, the confirmation click does not repair the consent problem. The subscriber still needs a clear choice before the confirmation email is sent.
- Tell people what type of email they are joining.
- A pre-ticked box does not establish valid consent.
- Leave marketing consent checkboxes unchecked; a sending-law exception does not turn a pre-ticked box into consent.
- A consent database needs the wording, timestamp, and confirmation state.
This is also why legal consent and inbox performance should be reviewed separately. A list can have consent and still perform badly if people do not remember signing up, if expectations are unclear, or if the first email arrives weeks later.
When single opt-in can still work
Single opt-in still has legitimate uses where applicable law permits it and consent can be demonstrated. Consider it when signup happens inside an account with a verified email address or after a purchase flow with a separate unchecked marketing choice. Account history and authentication logs can strengthen the connection between the person and the address. A pre-checked checkout box is invalid consent, and a logged-in session does not automatically satisfy country-specific verification expectations.
In the UK, PECR has two narrow soft opt-ins. The products and services soft opt-in covers directly collected details during a sale or qualifying negotiations, for the sender's own similar products or services, with opt-outs at collection and in each message. The charitable purposes soft opt-in applies only to charities collecting details directly through a person's qualifying interest or support, solely to further their own charitable purposes, with the same opt-out opportunities. It covers contact details obtained on or after 5 February 2026. The ICO's electronic mail guidance explains both exceptions; neither is consent, and each needs supporting records.
Website registration by itself is not newsletter permission. Account creation can justify necessary verification or service emails, but it does not authorize unrelated promotions. Marketing still needs a separate affirmative choice or a valid sending-law exception. A marketing message does not become a service email because it includes account information.
Use more caution with public forms, sweepstakes, co-registration, affiliate traffic and partner lead forms. These sources need reliable consent records and protection against third-party signups. Double opt-in does not authorize an unsolicited confirmation request to a purchased or scraped list, and engagement does not replace a required consent record.
Recommended opt-in default by signup risk
Recommended signup controls, subject to applicable law and a lawful basis to contact the address.
Low risk
Single opt-in where permitted
Verified account email and a separate affirmative marketing choice
Medium risk
Double opt-in preferred
Public newsletter form with clear brand context
High risk
Double opt-in before marketing
Sweepstakes or partner signup with valid, documented permission
A useful internal policy is simple: default to double opt-in for Germany and high-risk sources, allow single opt-in only where the user identity and consent trail are strong, and document the exception. That gives marketing, legal, and deliverability teams the same operating model.
For a narrower UK and EMEA angle, the separate UK and EMEA subscribers page covers the regional consent question in more detail.
Does double opt-in apply to B2B email marketing?
A business email address does not automatically remove consent requirements. Check the national sending rules and the recipient's legal status before deciding whether consent, a customer exception or another permitted route applies.
- In Germany, UWG section 7 generally requires prior express consent for marketing email to business recipients as well as consumers, unless the existing-customer exception applies. Use double opt-in for routine electronic-consent signups.
- In the UK, the ICO's B2B guidance distinguishes corporate subscribers, such as limited companies, from individual subscribers, including sole traders and some partnerships. PECR does not require prior consent for corporate email marketing, but the sender must identify itself and provide an opt-out. UK GDPR still applies to identifiable business contacts.
- In France, CNIL guidance permits professional email marketing based on legitimate interests when the offer relates to the recipient's professional role, the person is informed, and a simple, free objection is available.
Record which recipient category and national rule support the campaign. A publicly listed work address is not evidence that its user subscribed to a newsletter, and double opt-in does not remove transparency or unsubscribe duties.
How double opt-in affects deliverability
Double opt-in is a list-quality control. It keeps unconfirmed addresses out of marketing campaigns and reduces the risk of complaints caused by mistaken or third-party signups. The confirmation email itself still bounces if the address is invalid. Double opt-in also does not stop subscription bombing at the confirmation stage; add bot controls and rate limits per recipient address and signup source to prevent repeated confirmation messages.
Gmail's subscription guidance asks senders to confirm email addresses before subscription messages and honor opt-outs within 48 hours. Its bulk-sender rules require one-click unsubscribe headers for marketing and subscribed messages when the bulk threshold applies. These are mailbox-provider expectations, separate from national consent laws.
It can also reduce list growth, especially when the confirmation email is slow, unclear or delivered to spam. Test the confirmation email with Suped's email tester, inspect authentication results, and check delivery in controlled recipient mailboxes. Confirm that the message clearly asks the person to complete the subscription.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
A subscriber can still miss the confirmation email if authentication or sender reputation is poor. Use Suped's domain health checker to find common DNS and authentication problems, then test the confirmation flow itself. DNS checks do not establish inbox placement or consent.
Suped is our DMARC reporting and email authentication platform. In this workflow, Suped's DMARC monitoring uses receiver reports to show sending sources and authentication outcomes, helping identify failures affecting confirmation mail. Suped's blocklist monitoring checks domain and IP listings so the team can investigate blocklist (blacklist) issues affecting the confirmation or welcome flow.
Suped DMARC dashboard showing email volume, authentication health, and source breakdown
For a failed confirmation flow, compare the sending source in Suped with the service that sent the message, investigate SPF or DKIM failures, and retest the message after correcting the configuration. DMARC reports do not record subscription consent or prove inbox placement.
A practical implementation policy
A workable policy accounts for country and signup source. It should say what happens at signup, what gets stored, what the email service provider (ESP) accepts on import, and what happens to people who never confirm. Treat an IP-derived country as a signal, rather than proof of residence or the only basis for choosing national rules.
- Use double opt-in for routine German electronic-consent signups and as the default for public forms or sources with disputed-signup risk.
- Allow single opt-in only where national rules permit it and verified account or equivalent records support the affirmative marketing choice.
- Confirm the lawful sending basis and the ESP's permission rules before importing old lists or partner leads. Do not use reconfirmation email to seek missing consent where prior permission is required.
- Keep unconfirmed signups out of marketing audiences and exports. Use a documented retention window, such as 7 to 30 days, then remove unnecessary pending-signup data while retaining only separately justified suppression or audit records. This window is an internal policy example, not a statutory deadline.
- Do not assume an unconfirmed signup permits reminders. Send a reminder only if the original request and applicable local rules allow it.
- Make unsubscribe direct, record suppression state, and do not let login, surveys, or preference choices block a full opt-out.
- Keep consent text, timestamps, country signals, and confirmation state together.
- Use expiring, single-use confirmation tokens and an explicit confirmation action. Do not activate a subscription merely because an automated security scanner fetched the link.
Flowchart for deciding when to require double opt-in for email marketing consent by country and signup source.
The confirmation email should be narrow in purpose and free of advertising. Do not include offers or unrelated marketing. Keep the subject clear, make the confirmation action obvious, and tell the recipient to ignore the message if they did not request the subscription. The success page should confirm the subscription and show where to unsubscribe later. Send the first marketing email soon after confirmation while the signup is still fresh.
Check the ESP's permission and import policies before moving a list. These policies can be stricter than local law, regardless of where the provider stores data. Data residency and processor contracts do not replace consent records or a lawful sending basis.
The cleanest default
If the team lacks a documented consent model by country and source, use double opt-in for new subscriptions that people actively request. Keep pending addresses out of campaigns, preserve the consent wording, and review any exception before sending.
There is still room for nuance. For high-intent checkout subscriptions, prioritize clear consent and accurate expectations over extra friction for its own sake. For low-trust acquisition sources, require the confirmation click even if it costs list volume. A smaller list that wants the mail is better than a larger list that keeps complaining.
For teams comparing the upside and cost of confirmation flows, the double opt-in tradeoffs article goes deeper into growth, complaint rate, and engagement effects.
