Double opt in is usually presented as a choice between growth and quality: turn it on and the list gets smaller but cleaner. That framing is accurate and it skips the part that matters operationally, which is that the confirmation click and the consent are two different things, obtained at two different moments, and only one of them is a legal artefact.
Getting that distinction straight decides whether the extra step is buying anything, and it also explains most of the surprises people hit after switching it on.
What the second click proves, and what it does not
A confirmation click settles two facts. The address exists and accepts mail, which rules out typos and dead mailboxes. And somebody with access to that mailbox took an action, which rules out a third party typing in an address that is not theirs, whether by accident or maliciously.
That is the whole of it. Notably absent is what the person agreed to receive. That was fixed earlier, by the wording next to the signup field. If the form said nothing about marketing, a confirmation click does not retroactively turn a support enquiry into a newsletter subscription. If the form asked for a product update list and the sends turn out to be promotional, the click does not cover that either.
This is why a policy stated as "double opt in is enabled" answers a deliverability question well and a consent question badly. The click is evidence about the mailbox. The wording is evidence about the permission. Tightening the first while leaving the second vague fixes the easier half.
What the rules ask for, which is not a second click
The UK's position is representative of how these rules are drafted. Under the Privacy and Electronic Communications Regulations, the Information Commissioner's Office states that marketing email or text must not be sent to individuals unless they have specifically consented, or unless they are an existing customer who bought or negotiated to buy a similar product or service and were given a simple way to opt out both when their details were first collected and in every message since. That second route is commonly called the soft opt in.
Nothing in that describes a confirmation email. What the rules require is consent and an opt out route, plus not disguising the sender's identity and providing a valid contact address. Double opt in is a method of evidencing consent and validating the address, which is a sensible thing to be able to do when asked. It is not the thing being asked for.
Several boundaries in the same guidance are worth knowing because they change who the question even applies to. The term electronic mail is defined broadly and covers text, picture and video messages, voicemail and direct messages on social platforms, not just email. Sole traders and some partnerships are treated as individuals, while corporate bodies can be emailed, although the ICO describes keeping a do not email list of any that object as good practice. The soft opt in does not extend to prospective customers, bought in lists, or non commercial promotion such as charity fundraising and political campaigning. The guidance also carries a note that it is under review following the Data (Use and Access) Act, so the detail is worth rechecking rather than remembering.
Rules differ by country and none of this is formal advice. The point that travels is structural: the law is about consent and about being able to stop, and a confirmation click is one way of showing the first.
The four pieces the process makes you write
Switching the setting on creates content obligations that are easy to miss. Mailchimp's documentation lists the pieces that make up a double opt in signup: the signup form itself, a signup thank you page telling the person to go and check their email, the opt in confirmation email, and a confirmation thank you page shown after the link is clicked.
The confirmation email is the one that decides the outcome, and it is almost always the least edited of the four. It arrives from a sender the person has not corresponded with before, contains a single link, and asks for an action with no obvious benefit to the reader. Every property that describes that email also describes a phishing attempt, which is why the default template converts worse than it should. Naming the thing they signed up for, in the subject line, does more than any design change.
The thank you page matters more than it looks too, because it is the only chance to tell somebody that an email is coming and roughly when. Without that, a proportion of people assume the signup failed and either try again or leave.
Where the setting lives
Three widely used tools put the switch at three different levels, which changes how much control there is.
| Level the setting applies at | Available on | Notable constraint | |
|---|---|---|---|
| Mailchimp | Per audience | All plans | Set in audience settings under form settings |
| Klaviyo | Per list, with a default for new lists | All plans | Changing the default does not update existing lists |
| HubSpot | Account wide | Basic on free tools and Starter | Per form control needs Marketing Hub Professional or Enterprise |
HubSpot's split is the one to check before planning around it. Basic double opt in uses a default confirmation email with the sender, language and subject line customisable, and applies to all forms and pages. Turning it on for only some forms, customising the confirmation email, choosing the confirmation page or adding a follow up email after confirmation are documented as requiring a Professional or Enterprise subscription. A plan that involves confirmation on the newsletter form but not on the support form is therefore a pricing question, not a settings question.
The edge cases that decide whether it holds
This is where implementations come apart, and every item here is documented behaviour rather than folklore.
Imports skip it. Klaviyo's documentation states that list imports do not trigger double opt in. A confirmed list plus an imported spreadsheet is a list with two different provenances and one label.
Channel coverage is uneven. HubSpot's double opt in applies to marketing email only and cannot be used to manage WhatsApp or SMS subscriptions. In Klaviyo, double opt in exists for SMS as well, and a keyword's opt in setting overrides the list's, so a list configured one way can be entered another way. Klaviyo also notes that branded sender IDs cannot receive text messages, so in countries using one the confirmation text is skipped automatically.
SMS has outside requirements. Klaviyo advises against single opt in for SMS because some carriers require double opt in, and specifically for abandoned cart messages in the United States and Canada. Mailchimp similarly notes that double opt in is required to send abandoned cart text messages.
Confirmation attaches to the address, not the person. HubSpot's documentation is explicit that double opt in settings are tied to specific email addresses, and that if a contact's primary email address changes, the previous confirmation status does not apply to the new address. Somebody who changes job and updates their record becomes unconfirmed.
Non confirmers leave a trace, or do not. In Klaviyo, a person who does not confirm results in a blank profile that is not added to the list. In HubSpot, contacts who have not confirmed cannot be emailed at all, and a workflow that tries will retry the automated send for up to one day before giving up and moving on. Neither produces an error anybody sees.
Existing contacts are grandfathered unevenly. When HubSpot's setting is turned on, existing contacts who have previously been sent marketing email count as confirmed, while existing contacts who never were do not. Switching it on therefore silently freezes a segment of the database.
What it costs, and what it buys
The cost is the people who meant to subscribe and never confirmed. They do not appear as a failure anywhere; they simply are not on the list. Confirmation mail lands in a promotions tab or a spam folder, arrives while the person is already on the next thing, or gets opened on a phone where the link is tapped and the page fails to load.
The benefit is more concrete than list hygiene in the abstract. Klaviyo's documentation sets out the mechanism: major mailbox providers including Google and Yahoo track how recipients interact with mail from a sending domain, including spam complaints, opens and bounces, and use that to decide whether the mail is classified as spam. Invalid addresses and uninterested recipients degrade the signal for everyone else on the list. A smaller confirmed list is not only cleaner; it makes the mail that does go out more likely to arrive.
Mailchimp's guidance on when to choose it is usefully narrow: use double opt in if audience growth is not the priority, or if there have been low open rates or abuse complaints. Read the other way, if growth is the priority and deliverability is currently fine, the second click is buying less than it costs.
Both tools point at the same complementary measure, which is worth noting because it is often skipped. Mailchimp's hosted forms include a reCAPTCHA box, and its documentation says to enable reCAPTCHA in audience settings when using embedded or pop up forms. A bot filter at the point of signup addresses the same problem as double opt in from the other side, and costs no conversions.
Choosing, and then checking the handover
For a marketing list where volume matters and the signup is well worded, single opt in plus a bot filter on the form is defensible. For a list with existing deliverability trouble, an abuse complaint history, or transcription from paper and events where typos are common, the confirmation step earns its place. For SMS, carrier expectations may remove the choice.
One question sits outside all of that. A signup form is often not only a signup form: the same submission is also an enquiry, a trial request or an application that somebody has to act on. The confirmation step governs whether marketing can be sent, and governs nothing about whether a person replied. Keeping the operational side visible, where each submission carries an owner and a status, is a separate arrangement from the subscription state, and what a response record holds is the part to check against the tool being used for intake. The situations forms get used for sets out where the two overlap.
What to change first
Read the wording next to the signup field before touching the opt in setting, because that sentence is what the consent rests on and the confirmation click cannot repair it. Then rewrite the confirmation email so its subject names the thing being confirmed, since that single line decides how many people finish. If the same form also starts work for somebody, check that the intake side has an owner and a status of its own, which is what Halict is for.
Q1. Does GDPR require double opt in?
Consent requirements and confirmation clicks are different things. UK guidance under the Privacy and Electronic Communications Regulations requires specific consent, or the soft opt in for existing customers who were given a clear opt out, plus a valid contact address and no disguising of the sender. Double opt in is a way of evidencing consent and validating the address rather than a stated requirement, and the detail varies by country, so confirm the position for the jurisdictions you send to.
Q2. How many subscribers are lost by adding a confirmation step?
Enough to matter, and it varies too much by audience and industry for any published figure to transfer. The way to find out is to measure it directly: count signups and confirmations for a few weeks and treat the gap as the cost. Mailchimp's own guidance suggests choosing double opt in when growth is not the priority, which is the same trade off stated from the other direction.
Q3. Do imported contacts get a confirmation email?
Not automatically. Klaviyo documents that list imports do not trigger double opt in, and HubSpot treats contacts created by import as needing their subscription types confirmed separately, with the option of sending a confirmation email manually from the contact record. A list that mixes confirmed signups with an imported spreadsheet has two different provenances under one label.
Q4. What happens if somebody never clicks the link?
They are not added, and nothing raises an alarm. Klaviyo creates a blank profile that is not on the list. HubSpot will not let the contact be emailed, and a workflow attempting an automated send retries for up to one day before moving on. Both outcomes are invisible unless somebody looks for the difference between signups and confirmations.
Q5. Does double opt in apply to SMS as well?
It depends on the tool. HubSpot's double opt in covers marketing email only and cannot manage WhatsApp or SMS subscriptions. Klaviyo supports it for SMS, where a keyword's own opt in setting overrides the list's, and advises against single opt in because some carriers require confirmation, including for abandoned cart messages in the United States and Canada. Where a branded sender ID is used, the confirmation text is skipped automatically because that sender cannot receive replies.