Opt-in

Also called consent

An opt-in is a person's explicit agreement to receive messages from you, and under GDPR it must be given by a clear affirmative act.

Consent has to be freely given, specific, informed and unambiguous. In practice that rules out pre-ticked boxes, consent bundled into terms of service, and any design where agreeing is the only way to proceed with something unrelated.

Double opt-in adds a confirmation email that must be clicked before the address is added. It costs a share of sign-ups and buys a list of verified, genuinely interested addresses, better deliverability, and a timestamped record of consent — which is what a regulator asks for.

You must be able to show when and how each contact consented. Storing that alongside the address, at the moment of collection, is far easier than reconstructing it later.

In practice

A checkbox reading "Email me new template releases", unticked by default, next to a checkout button — separate from the purchase itself.

Common mistake

Adding buyers to a marketing list automatically. Purchase consent and marketing consent are legally distinct.

Opt-in

In practice

Common mistake

Read more on this