What is double opt-in?

Why is double opt-in standard practice, even though no law explicitly requires it?

Under Section 7(2) No. 2 UWG, advertising by email or SMS is in principle only permitted with the addressee’s prior express consent; the narrow exemption for existing customers is set out in Section 7(3) UWG. At the same time, under Art. 7(1) GDPR, the controller must be able to demonstrate that consent has been given. Without confirmation, anyone could enter someone else’s address – and the proof would be worthless.

The Bundesgerichtshof (Federal Court of Justice) has regarded the double opt-in process as suitable for proving the address owner’s consent to email advertising; the burden of proof lies with the advertiser. For consent to telephone advertising, however, a sign-up confirmed by email is not sufficient (BGH, judgment of 10 February 2011, I ZR 164/09).

In practice, this includes: a confirmation email without advertising content, storage of the time of sign-up and of confirmation as well as the version of the consent text, and an unsubscribe link in every subsequent email. Withdrawing consent must be as easy as giving it (Art. 7(3) GDPR). Anyone who does not confirm is not added; the unconfirmed sign-up is deleted after a short period.