Confirmed opt-in (double opt-in): what it costs, and what it buys

What it actually is

Single opt-in: an address is typed into a form and starts receiving mail. Confirmed opt-in: an address is typed into a form, receives exactly one message asking whether it really was them, and starts receiving mail only if the link in that message is clicked. Everything else — the welcome sequence, the preferences page, the tagging — is the same. The whole of the difference is one email and one click.

The word “double” is a misnomer that has caused real confusion, because it makes it sound like a second form or a second act of typing. It is not. From the reader’s side it is a single extra click, in a message they were expecting, within seconds of asking for it.

The problem it solves is not the one people describe

The usual argument for confirmation is consent, and it is a good argument, but it undersells the mechanism. The concrete problem is that an email form accepts any string that looks like an address, and a meaningful share of what arrives is not the person in front of the keyboard. Typos are the largest category: one transposed character and you are mailing a stranger, forever, with no way to find out. Then there are the addresses typed deliberately by someone who wanted the free download but not the mail, addresses belonging to a colleague, and — at any scale at all — bots filling in forms for their own reasons.

Every one of those is, from a mailbox provider’s point of view, indistinguishable from you having bought a list. They bounce, or they sit and never open, or they hit the spam button, and all three are measured. A confirmation link removes almost all of them before they ever count against you, because none of those categories clicks a link.

There is a second, quieter benefit. A confirmation click is a timestamped, logged, unambiguous act by the person who owns the address. When somebody claims a year later that they never signed up, that record is the only thing that settles it. A form submission proves that a browser sent you a string; a confirmation click proves that whoever reads that mailbox wanted this.

What it costs, honestly

It costs list size. Somewhere between ten and thirty per cent of people who submit a form never click the confirmation, and anyone who tells you the number is smaller is describing their own audience rather than yours. That is a real cost and it should be stated plainly rather than argued away, because it is the whole reason single opt-in persists.

The honest counter-argument is that the drop is concentrated in exactly the addresses you would not have wanted: the mistyped, the reluctant, the distracted, the automated. The list is smaller and the open rate is higher, and the second of those is not a vanity statistic — it is the input to your sender reputation, which is what decides whether the next message reaches an inbox at all.

The cost that is genuinely avoidable is a bad confirmation experience. Most of the unconfirmed are not refusing; they are people whose confirmation email arrived looking like a phishing attempt, or landed in Promotions, or said “Confirm your subscription” with no indication of what they were subscribing to. Make that email look like you, name the thing they signed up for, say what arrives and when, and put the link where a thumb lands.

What a confirmation email should contain, and what it should not:

• The name of the specific thing they asked for, not “our newsletter”. A reader who signed up eleven seconds ago on a page they have already closed still needs reminding.
• What happens after the click, in one sentence, including when the first real email arrives.
• One obvious link or button, and the same URL again as plain text underneath, because some clients mangle buttons and some readers do not trust them.
• Nothing else. No offer, no second call to action, no “while you are here”. This message has one job and every additional element lowers the click rate on the only thing that matters.

Where the law sits, and where it does not

It is worth being precise, because a lot of marketing copy is not. The GDPR does not require confirmed opt-in by name. It requires that consent be freely given, specific, informed and unambiguous, and that you be able to demonstrate it. Confirmed opt-in is the cheapest and most durable way to be able to demonstrate it; it is not the only conceivable one, and the regulation names no mechanism.

The American CAN-SPAM Act does not require any opt-in at all. What it requires is an accurate From line, a functioning unsubscribe honoured within ten business days, and a valid physical postal address in every commercial message. It is a rulebook about how you mail people, not about how you acquired them, and it is much weaker than most European readers assume.

Some jurisdictions are stricter than both. Canada’s anti-spam law requires express or clearly implied consent with records, and the penalties are not theoretical. If you have readers in more than one country — and if you publish anything in English you do — the practical answer is to run the strictest version everywhere rather than to maintain several lists under several rules.

The mailbox providers have settled the argument anyway

Since 2024 the large providers have published their own requirements for anyone sending in bulk, and they are enforced by the only mechanism that really matters: whether your mail is delivered. Authentication with SPF, DKIM and DMARC is now a floor rather than a nicety. One-click unsubscribe in the message headers is required, not suggested. And there is a published complaint-rate threshold — spam reports as a fraction of delivered mail — above which delivery degrades.

That threshold is the part that quietly ends the single-opt-in debate. Complaint rates are dominated by people who do not recognise the sender, and the surest way to be unrecognised is to have been added to a list by a typo or by somebody else. A list built on confirmation sits far below the threshold almost by construction. A list that is not can sit above it for months before anyone notices, because nothing reports the failure to you: mail simply stops arriving in inboxes and starts arriving in spam folders.

The practical upshot is that confirmed opt-in has stopped being a values position and become an operational one. It is what keeps a sending reputation intact, and a sending reputation is the only asset in email that cannot be bought back once it is spent.