Double opt-in vs single opt-in: which should you use?

More sign-ups,or fewer problems.

Use double opt-in when the law or your proof needs it, or when sign-ups are easy to fake. Use single opt-in when people join your own site because they asked to. Single opt-in adds someone to your list the moment they submit their address. Double opt-in emails them a link first and adds them only when they click it. The click keeps out typos, bots and people signed up by someone else, and it costs you the real subscribers who never click. The picker below turns your country, sign-up source and traffic into a plain answer.

Which one for me? Start free
Single or double A decision guide not legal advice

By the Builderify team

An example, made up for this page

01 Someone signs up 02 A link goes out 03 The click decides
01 / The short answer

What is double opt-in,
and how does it differ?
One step, or two.

Single opt-in subscribes someone the moment they submit their address. Double opt-in, also called confirmed opt-in, emails them a link first and subscribes them only when they click it. The click is the point: it shows that the person who typed the address can open mail sent to it.

The big senders lean one way. Yahoo advises a confirmation click, Google says to confirm each recipient’s email address before subscribing them, and Spamhaus lists confirmed opt-in among its minimum requirements for senders. The law is more mixed, which is chapter 02.

The two routesSame form

  • Single opt-in

    1. 1Form submitted
    2. 2On the list
    3. 3Welcome email

    The person is a subscriber the moment they press the button.

  • Double opt-in

    1. 1Form submitted
    2. 2Confirmation email
    3. 3Link clicked
    4. 4On the list
    5. 5Welcome email

    The two extra steps are the whole difference. The person is a subscriber only after the click.

Single opt-in and double opt-in compared on seven points
What changes Single opt-in Double opt-in
Who ends up on the list Everyone who submits Only people who click the link
Typos and fake addresses They get in, then bounce The email never arrives, so they stay out
Signing up someone else Possible: the owner gets mail they never asked for Blocked: only the mailbox owner can click
Spam complaints More people who didn’t expect you Fewer, say Spamhaus and Yahoo
Proof that someone agreed Your form record: when, where, what they saw The same record, plus a click from the mailbox owner
First email Goes out at once Goes out after the click
Work for you None A confirmation email, a check-your-inbox page and a plan for people who never click

What confirmation keeps out and what it does for complaints come from Spamhaus’s advice for marketers and Yahoo’s Sender Hub, read on 1 November 2026. The rest follows from how the two routes work. If your email already lands in spam, start with why business emails go to spam.

02 / What the law says

Is double opt-in the law?
Rarely. Germany expects it.

Most places ask for consent you can prove, and few say how. Of the places below, only Germany treats the confirmation email as the expected proof. This is general information, not legal advice, and it covers email to people, not texts or calls.

What each place asks for before a marketing email, and whether double opt-in is required
Where What it asks Double opt-in?
United States The CAN-SPAM Act asks for no permission before a marketing email. It asks for an honest sender, your postal address and a working opt-out. FTC Not required
United Kingdom PECR asks for consent you can show, unless the soft opt-in applies. The ICO lists ticking an opt-in box among the valid ways to give it, and asks you to record who agreed, when, how and what they were told. ICO Not required
EU The GDPR asks for a clear affirmative action that you can demonstrate. The EDPB says it doesn’t prescribe exactly how, and suggests keeping a record of the consent statements you receive. EDPB Not required
Germany The UWG asks for the addressee’s prior express consent to marketing email, and you have to prove it. The federal data protection commissioner calls double opt-in the legally safest proof, and the Hanover chamber of commerce says a single opt-in alone is not enough. BfDI Expected in practice
Canada and Australia Both ask for consent, and whoever claims it has to prove it. The ACMA lists filling in a form or ticking a box on a website as express consent, and asks you to keep who agreed, when and how. CASL Proof of consent

Sources read on 1 November 2026. For the German rule, section 7 of the UWG asks for the prior express consent of the addressee. For Canada and Australia, CASL and the ACMA are where proof of consent is set out.

A click is evidence, not a free pass

In 2011 Germany’s Federal Court of Justice (I ZR 164/09) said that once the requested confirmation arrives, it can be assumed the request came from that address, and that a ticked box then documents consent to email advertising. It also said that someone who shows the confirmation wasn’t theirs can still win.

The confirmation email can’t sell

The Hanover chamber of commerce says the confirmation email has to be free of advertising, and that a single opt-in alone is not enough because a stranger could have typed someone else’s address. Keep the confirmation to the confirmation.

Who you may email at all

This table is only about confirming. Whether you may email a customer or a contact in the first place is a different question: can you email customers without consent? covers five places, and the CAN-SPAM checklist covers what every US marketing email needs.

03 / Which one for me?

Single or double opt-in:
which should you use?
Three answers, one verdict.

Say where your subscribers live, how they join and where they come from, and the picker gives a verdict with the reasons and the trade-off. It is a rule of thumb built from the sources in chapters 01 and 02, not legal advice. It starts with a US list, a form on your site and mostly known visitors; change anything. Nothing you pick leaves your browser.

Opt-in picker · for email sign-ups
Where do most subscribers live?
How do people join?
Where do the visitors come from?
What else is true? Tick any

US · Site form · Known visitors

Single opt-in is enough for you.

Nothing in your answers calls for a confirmation step. Keep a record of how each person agreed, and check the address before you send.

Why US law asks for no permission before a marketing email, so it doesn’t call for a confirmation step. People who join through your own form asked for it, which is the case single opt-in suits. People who know you are less likely to report your email as spam.

You gain

Every real sign-up, and a welcome email that goes out at once.

You give up

Typos, fake addresses and people signed up by someone else can get in, and a form alone doesn’t show that the mailbox owner agreed.

What to do next

  1. 1Put what they will get, and how often, next to the button.
  2. 2Check each address for typos and dead domains before the first email (chapter 05).
  3. 3Keep who agreed, when, from which page and the words they saw.

The law there The CAN-SPAM Act asks for no permission before a marketing email, so US law doesn’t call for double opt-in. It asks for an honest sender, your postal address and a working opt-out.

In Builderify Builderify fits this route: it checks each new address before subscribing it and keeps a consent record for every sign-up (chapter 06).

A rule of thumb, not a ruling

The picker weighs what you tell it against the sources in this guide. It can’t see your list, your traffic or your lawyer’s view, so where they disagree with it, believe them.

You can mix the two

Nothing says every list needs the same route. A form on your own site can run single opt-in while a giveaway runs double. Keep the proof for each.

Already have a list?

Moving to double opt-in doesn’t change who is on it today. For who you may email at all, can you email customers without consent? is the place to start.

04 / Running double opt-in

How do you run double opt-in
without losing people?
Make the click easy.

A good double opt-in is a short, plain email with one button, sent the moment someone signs up, with nothing else going out until they press it. The people you lose are the ones lost between the form and the click, so shorten that gap.

  1. 01

    Say what is coming, next to the button

    Tell people what they will get and how often before they submit. Yahoo advises setting those expectations when people subscribe, and Google says people who want your email are less likely to report it as spam.

  2. 02

    Show a check-your-inbox page

    Right after the form, say that an email is on its way, who it is from, and to look in spam or promotions if it doesn’t show. Offer a way to send it again.

  3. 03

    Send the confirmation at once

    A subject that names your business, one button and one line on what they will get. Keep advertising out of it: the Hanover chamber of commerce says a confirmation email has to be free of it.

  4. 04

    Mail nobody who hasn’t clicked

    Spamhaus says a person who doesn’t click gets no further email of any kind from you. Delete addresses that never confirm after a set time, such as a week, instead of keeping them.

  5. 05

    Keep the record and the click together

    Store the form entry (when, from which page, the wording they saw) and the confirmation (when, from which address). In Germany’s top civil court, proof meant storing each person’s declaration so it can be printed on demand.

Confirmation emailA plain template

Subject

Confirm your subscription to [Your business]

Message

Hi,

Someone, hopefully you, asked to join [Your business]’s email list. You will get [what you send, and how often].

To confirm it was you, press the button:

Yes, subscribe me

If it wasn’t you, ignore this email. You won’t be subscribed and we won’t write to you again.

One button, no promotions, no other links
05 / Making single opt-in safer

How do you run single opt-in
without a dirty list?
Six habits, and one gap.

Single opt-in works when the promise is clear, the address works, the form is guarded, the first email goes out at once, you can show who agreed and you watch the complaints. None of that proves the mailbox owner agreed. Only a confirmation click does, and that is the gap you accept.

  1. 01

    A clear promise

    Say what they will get, how often and from whom, next to the button, as Yahoo advises. Where you ask for marketing consent, leave the box unticked: the ICO says you can’t rely on pre-ticked boxes, and Google advises against forms that are checked by default.

  2. 02

    An address check

    Catch typos, dead domains and throwaway addresses before the first email, so they never bounce. It proves the address works, not that its owner agreed: Spamhaus says list validation is “not and never will be a replacement for permission”.

  3. 03

    A guarded form

    Add a CAPTCHA or a similar check to the form, as Spamhaus recommends, so bots can’t pour made-up addresses into your list. A burst of sign-ups from one place in a few minutes is the sign to look for.

  4. 04

    A first email people recognize

    The first email is where someone who didn’t ask finds out. Send it at once, from a name they know, say why they got it and put an unsubscribe in it. Make leaving easier than reporting you: Google says user spam reports can lower a domain’s reputation over time.

  5. 05

    A record you can show

    Keep who agreed, when, from which page and the words they saw. That is what the ICO asks you to record, and the EDPB suggests keeping a record of the consent statements you receive.

  6. 06

    Complaints you watch

    Google asks senders to keep reported spam under 0.10% and never reach 0.30%: on 1,000 emails, 0.10% is one report. Read the number in Postmaster Tools and stop mailing anyone who reports you. Gmail and Yahoo’s rules say what a miss costs.

The gap that stays

Someone can still type another person’s real address, and it stays on your list until that person unsubscribes or reports it. A confirmation click is the one step that stops it, which is why Spamhaus and Yahoo advise one and Germany expects one. Chapter 04 is how to run it.

06 / In Builderify

What Builderify does:
single opt-in, with the address checked.

Builderify doesn’t send a confirmation email to new sign-ups. It adds each person at once, checks that the address can receive mail, and subscribes only the addresses that pass. Someone who joins a Leads list from a popup or form receives nothing from a sequence or a broadcast until the check answers.

01

Checked before the first email

A new sign-up with an email address starts as Verifying email and gets nothing yet. An email verification service checks the address: one that can receive mail becomes a subscriber, and any sequence running on that list picks it up. Anything else is marked Invalid email.

02

Bad sign-ups stay out

Disposable addresses are kept for your records but never mailed or charged. A burst of sign-ups from one internet address or network is held for review: no email and no credits until you approve it.

03

A consent record for each sign-up

Builderify keeps when they signed up, from which page and IP address, and the words they saw. The contact’s page shows the date, the IP address and the wording under Consent.

04

Unsubscribes stick

Every campaign and sequence email carries an unsubscribe link and supports one-click opt-out. Someone who unsubscribed isn’t added back by signing up again.

What it costs

One credit per new person.

A new person costs 1 credit, charged when the sign-up arrives rather than when the address passes. The same person signing up again, or joining a second list, costs nothing. Disposable addresses and your own test sign-ups are never charged, and a held sign-up is charged only if you approve it. See the pricing page for the whole rate card.

250 free

credits every month, with no monthly fee

1 credit

per new person, charged on sign-up

From $9

for a one-time pack of credits that never expire

When it isn’t the right fit

If you need double opt-in, Builderify can’t do it for new sign-ups today. It checks that an address can receive mail, not that its owner agreed, and Spamhaus says address validation is not a replacement for permission. For Germany, or for lists you build from giveaways and paid traffic, use a tool that sends the confirmation email. It also can’t decide which law applies to a contact: who you may email is the place for that.

Connect a popup or form to a lead list, and each person who joins it is checked before anything is sent. How to create a waitlist walks through the whole path.

Start free
Questions

Double and single opt-in, answered.

Double opt-in, also called confirmed opt-in, is a two-step sign-up. Someone submits their email address, you send a confirmation email, and they join your list only when they click the link in it. The click shows that the person who typed the address can open mail sent to it.

Single opt-in subscribes someone the moment they submit their address. Double opt-in waits for a click on a confirmation email. Single keeps every sign-up and lets in typos, bots and people signed up by someone else; double keeps those out and loses the real subscribers who never click.

No. The GDPR asks for consent that is a clear affirmative action and that you can demonstrate, and the EDPB says it does not prescribe exactly how. A record of who agreed, when and to what can do it. In Germany double opt-in is the expected way to prove it. This is general information, not legal advice.

Section 7 of the UWG asks for the addressee's prior express consent, which you have to prove; it does not name a confirmation email. In practice it is the expected way: the federal data protection commissioner calls double opt-in the legally safest proof, and the Hanover chamber of commerce says a single opt-in alone is not enough, because someone can type another person's address. This is not legal advice.

Spamhaus and Yahoo say confirming sign-ups keeps typos, fake addresses and bots off a list, and Spamhaus counts fewer spam reports among the benefits. Google advises confirming each recipient's email address before subscribing them. Nobody guarantees fewer complaints, but a list of people who clicked starts with fewer who did not expect you.

Yes. Some people never see the confirmation email, it can land in spam, or they forget to click, and those people never join the list. The ones who do click are the ones who meant it, so the list is smaller and cleaner. Make the click easy: one button, sent at once, with a check-your-inbox page.

No. Builderify does not send a confirmation email to new sign-ups. It adds the person as Verifying email, checks that the address can receive mail, and subscribes it if it can, keeping a record of when they signed up, from which page and with what wording. If you need double opt-in, use a tool that sends the confirmation.

Sources

The provider and law pages were read on 1 November 2026. Senders and regulators change their advice from time to time, so check the page before you rely on a detail; the German sources are in German and the translations here are ours. This guide is general information, not legal advice. The Builderify details come from the product itself and the rate card on this site. The people and addresses in the pictures are made up.

← All guides

Stop losing the visitors
you already paid for.

More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.

Start free See what it does