Double opt-in: how to build an email list legally.
An email list is worth having only if you may write to it. Here is what the law asks for marketing email in the EU, Germany and the United States, double opt-in step by step, the exception for existing customers, and unsubscribing the way Gmail and Yahoo now expect.
Updated 16 October 2026
The short version.
- In the EU, a marketing email needs the person's prior consent, with one narrow exception for your existing customers. You must be able to prove the consent, and withdrawing it must be as easy as giving it.
- In Germany, email advertising without prior express consent is always an unreasonable nuisance under competition law, and the Federal Court of Justice has held that a confirmed double opt-in, with the consent ticked, documents that consent in principle.
- In the United States, CAN-SPAM needs no consent, but every marketing email needs a way out that works for 30 days after sending, honoured within 10 business days, and your postal address.
- Gmail and Yahoo expect a one-click unsubscribe in marketing mail and an unsubscribe honoured within about two days.
Keep for every subscriber
- The address, and what they agreed to receive
- When they signed up, and when they confirmed
- The words of the form they agreed to
- When they unsubscribed, so they are never added again
Double opt-in, step by step.
- The form
An email field and an unticked box saying what they will get and how often: "Our monthly news and offers, about once a month." Nothing pre-ticked, nothing hidden in your terms.
- The confirmation email
Sent at once, to that address, asking them to confirm. Keep it to the confirmation: what they signed up for, one button, and nothing else.
- The confirmation
Only when they press it are they on your list. A button they press is better than a link that confirms by being opened, because mail scanners open links on their own.
- The record
Store the sign-up and the confirmation so you can show them at any time. That record is what the double opt-in is for.
Your existing customers.
The EU allows one exception. If you got a customer's email address when they bought from you, you may email them about your own similar products or services, provided they were clearly given the chance to object, free of charge, when you took the address and in every message since.
Germany sets four conditions that must all be met: the address came from the customer in connection with a sale, you advertise your own similar goods or services, they have not objected, and you told them clearly, when you took it and with every use, that they can object at any time. If in doubt, ask for consent instead.
Unsubscribing, done right.
- A link in every email, clearly visible, that works without signing in.
- One-click unsubscribe headers (RFC 8058), so the mail app's own "Unsubscribe" button works. Gmail has required them since 2024 from senders of about 5,000 messages a day.
- Honour it at once. Google recommends within 48 hours and Yahoo asks for two days; the GDPR asks that withdrawing is as easy as consenting.
- Never add them back from an old list or an import.
How Neaion does it.
Your office gives your business a sign-up page with double opt-in: the confirmation email carries a button, and only pressing it adds the address. Every newsletter goes only to consents that still stand, checked again for each person as it is sent, with a personal unsubscribe link, one-click unsubscribe headers and, for a US business, your postal address. Someone who unsubscribed is never added back by an import. The words of each newsletter are checked against the advertising rules of your country before it can go. See how your office sends newsletters.
It never
- Sends marketing to someone with no consent on record
- Asks for a sign-in to unsubscribe
- Re-adds an address that unsubscribed
Asked before you start.
Is double opt-in required by law?
Not word for word. EU law asks for prior consent you can prove; in Germany the Federal Court of Justice has held that a confirmed double opt-in documents that consent in principle, which is why it is the usual way there.
Can I email my existing customers without asking?
In the EU, about your own similar products, if they were clearly offered a free way to object when you took the address and in every email since. If in doubt, ask for consent.
Do I need consent in the US?
CAN-SPAM needs no consent, but every marketing email needs a working opt-out, honoured within 10 business days, and your postal address.
What is one-click unsubscribe?
Two email headers (RFC 8058) that let a mail app's own Unsubscribe button remove someone without them visiting a page. Gmail requires them in marketing mail from senders of about 5,000 messages a day.
Sources
The rules and dates on this page come from these sources, read on the day shown. This guide is general information, not legal or tax advice: rules change and your case may differ, so ask your adviser before you rely on it. If something here is out of date, write to us at hello@neaion.com and we will correct it.
- Regulation (EU) 2016/679, the GDPR, articles 4(11) and 7, checked 16 October 2026
- Directive 2002/58/EC (ePrivacy), article 13, checked 16 October 2026
- § 7 UWG: unreasonable nuisance (Germany), checked 16 October 2026
- Federal Court of Justice, 10 February 2011, I ZR 164/09, Double-opt-in-Verfahren (Germany), checked 16 October 2026
- FTC: CAN-SPAM Act, a compliance guide for business, checked 16 October 2026
- Google: email sender guidelines, checked 16 October 2026
- Google: email sender guidelines FAQ, checked 16 October 2026
- Yahoo: sender best practices, checked 16 October 2026
- RFC 8058: signaling one-click functionality for list email headers, checked 16 October 2026
Read next
Set up your office in an afternoon.
Free to set up, no card needed. It reads your website, asks what it could not find, and nothing goes live until you have checked it.