Is double opt-in required? Rules by country and by tool

Double opt-in means the subscriber confirms their sign-up by clicking a link in an email they receive after filling in the form. Only that click adds them to the list. This page is read directly from the laws and from the authorities’ own guidance, and every claim links to its source.

The short answer

No law in the countries on this page requires double opt-in. All of them do require prior consent from consumers for email marketing, and the burden of proof is on the sender. Double opt-in is in practice the only way to show afterwards that the consent came from the owner of the address and not from someone else using it. In Germany the authorities expect it; in Norway and Denmark they recommend it. If your list is Nordic or German, switch it on.

What EU law requires

The national rules share a base. Under Article 13 of the ePrivacy Directive, email may be used for direct marketing only to recipients who have given their prior consent. The exception is an existing customer whose address was obtained in the context of a sale: they may be sent marketing for the sender’s own similar products, as long as objecting is easy and free both when the address is collected and in every message.

The other half comes from Article 7(1) of the GDPR: where processing is based on consent, the controller must be able to demonstrate that the data subject has consented. So the law says what has to be proven, but not how. The national authorities answer that question, and they answer it differently.

The rules by country

← scroll →

Sources linked below by country, read on 24 September 2026. “Not mentioned” means double opt-in was not found on the authority’s page, not that the authority rejects it.

Finland

Section 200 of the Act on Electronic Communications Services allows direct marketing by email only to natural persons who have given their prior consent. The Office of the Data Protection Ombudsman adds that a company must be able to demonstrate afterwards that the person gave consent to the processing of personal data for electronic direct marketing. The page does not mention double opt-in. The other conditions for consent and the customer exception are covered in our guide to email marketing and GDPR.

Sweden

Section 19 of the Swedish Marketing Act allows email marketing to a natural person only if they have consented in advance. The data protection authority IMY advises documenting how and when consent was obtained and what information the data subject was given. The guidance does not name double opt-in.

Norway

Section 15 of the Norwegian Marketing Control Act prohibits marketing by email to natural persons without the recipient’s prior consent. The consumer authority Forbrukertilsynet says in point 2.6.1 of its guidance that traders “bør” — should — use a double opt-in model, so that consent collection is clear and nobody signs someone else up. In the same point the authority cites a 2012 Oslo District Court judgment: double opt-in is not a requirement, but a company that skipped it took a risk as to the quality of its consent records. The burden of proof, the guidance says, is on the trader.

Denmark

Section 10 of the Danish Marketing Practices Act prohibits email marketing to “nogen” — anyone — without prior consent, so it covers businesses too. The Consumer Ombudsman’s guidance (updated 14 June 2021) recommends a double opt-in model and says a plain confirmation email is unlikely to carry the same evidential weight. The guidance has two further points worth noting. First, an email asking for consent is itself marketing in Denmark, so you cannot email addresses you have no consent for to ask whether they would like your newsletter. Second, the evidence must be kept for two years after the consent was last used.

Germany

Section 7 of the German Act against Unfair Competition (UWG) treats email advertising as an unreasonable nuisance in every case where the recipient has not given prior express consent. The provision covers every recipient, not only consumers. That makes Germany the strictest country, and the background is in the next section.

Netherlands

Article 11.7 of the Dutch Telecommunications Act writes the burden of proof into the law itself: unsolicited commercial messages are prohibited “tenzij de verzender kan aantonen” — unless the sender can prove — that the recipient gave prior consent. The Authority for Consumers and Markets, ACM, says consent must be provable for five years after sending. ACM does not mention double opt-in.

Why Germany is the strictest

In Germany the question has been settled in court and in authority guidance. The Federal Court of Justice (BGH, 10 February 2011, I ZR 164/09) required the advertiser to document each consumer’s consent in full, which for consent given electronically means storing it and being able to print it at any time. In the same judgment the court found that where a consumer has confirmed a sign-up through double opt-in, consent to email advertising to that address is in principle sufficiently documented. The confirmation email does not, however, prove consent to telephone marketing.

The authorities go further. According to the joint direct marketing guidance of the German data protection authorities (DSK, February 2022), the double opt-in procedure is “geboten” — called for — to verify consent given electronically, and merely storing an IP address is not enough. According to the Federal Commissioner for Data Protection, double opt-in is “notwendig” — necessary — whenever a newsletter contains advertising. For a German list, double opt-in is therefore mandatory in practice, even though the law does not name it.

What to store about consent

Put together from the authorities’ guidance, the evidence has to show who consented, when, how and to what. In practice that means four things:

1. The time of the sign-up and of the confirmation, each separately.
2. The form or page the sign-up came from.
3. The consent text as the subscriber saw it. IMY’s guidance names the information given as its own item.
4. The content of the confirmation email, because the BGH requires the evidence to be printable.

You can store the IP address as well, but it is not enough on its own: the DSK guidance says an IP address alone is not proof, and in the case it decided the BGH found that the IP number could not be linked to the consumers. How long to keep the evidence depends on the country. The Danish guidance requires two years after last use and ACM five years after sending.

Double opt-in in seven email tools

All seven tools we compare offer double opt-in, but their defaults differ. In three of them it is off unless you switch it on.

← scroll →

Read from each tool’s own help page on 24 September 2026. “Does not say” means the information was not found in the help page, not that the feature is missing.

Two differences affect the price directly. According to the MailerLite and EmailOctopus help pages, subscribers awaiting confirmation do not count towards the subscriber limit, so double opt-in costs nothing. According to ActiveCampaign, on accounts created on or after 3 November 2025 all contacts count regardless of status, so unconfirmed contacts take up room on the list until they are deleted. Systeme.io deletes an unconfirmed contact itself within 24 hours.

If your list is German, Mailchimp, GetResponse and EmailOctopus need a setting changed before the first form goes live. On record-keeping, Mailchimp and GetResponse are the only ones whose help pages say they store both the confirmation time and the IP address in the subscriber record.

What to do now

1. Switch double opt-in on for every sign-up form, including where the tool defaults to single opt-in.
2. Write the confirmation email yourself: one sentence on what the subscriber gets, and the link. In Denmark a request for confirmation is already marketing, so do not send it to addresses you have no consent for.
3. Save the consent text every time you change the form, and keep the old versions.

If you are still choosing a tool, the comparison of email marketing software shows prices at three list sizes, and the free email marketing comparison shows where the free plans run out.