Double Opt-In: When It's Worth It (and Klaviyo Setup)

Double opt-in is the most argued-about setting in email marketing. Deliverability people love it. Growth people hate it. Both are right, which is why “always” and “never” are both the wrong answer for an ecommerce brand.

This guide covers what double opt-in actually does, when the lost sign-ups are worth it, where it’s legally expected (Germany, mainly), and exactly how to set it up in Klaviyo so confirmation doesn’t kill your welcome flow revenue.

---

What is double opt-in?

Double opt-in (DOI) is a two-step sign-up: a person submits their email, then clicks a confirmation link sent to that address before they’re added to your list. It proves the address is real, that its owner wanted to subscribe, and when they did, at the cost of losing sign-ups who never click.

Single opt-in (SOI) skips the second step: submit the form, and you’re on the list.

	Single opt-in	Double opt-in
List growth	Faster	Slower, because some sign-ups never confirm
Typos and fake addresses	Get in, then bounce	Filtered out
Bots and malicious sign-ups	Get in	Filtered out
Spam traps	Can get in via typos and form abuse	Very unlikely to get in
Proof of consent	Form submission record	Form submission plus confirmation click
Welcome flow starts	Immediately	After confirmation
Legal requirement	Acceptable in most markets	De facto standard in Germany

---

The honest case for and against

What double opt-in gets you

• A cleaner list from day one. Mistyped addresses (gmial.com), fake entries and bot submissions never reach your sending segments. That means fewer hard bounces and fewer spam traps, which protects the sender reputation behind every campaign.
• Stronger consent evidence. A logged confirmation click is harder to dispute than a form submission. Under GDPR you must be able to demonstrate consent, and in Germany it’s the accepted way to do so.
• Higher engagement averages. Everyone on the list has already opened and clicked at least once. That’s a useful starting signal for Gmail and Yahoo, whose sender requirements hold you to a spam rate below 0.3%.

What it costs you

• Lost subscribers. A share of people who fill in your form never confirm. The email lands in Promotions, they get distracted, or they only wanted the discount code on screen. Measure your own confirmation rate rather than trusting anyone’s industry average.
• A delayed welcome flow. Your highest-intent moment is the minute after sign-up. DOI puts a confirmation step between the sign-up and your welcome offer.
• More moving parts. Confirmation emails have to be delivered, branded and tested like any other email.

The trade-off is simple to state: DOI trades list size for list quality. Whether that’s a good trade depends on where your sign-ups come from.

---

When double opt-in is worth it

Turn it on when the quality problem is bigger than the growth cost:

• Giveaways, contests and sweepstakes. Entry-driven sign-ups attract throwaway and fake addresses. Confirmation filters them out before they drag down engagement.
• Partner and co-registration lead gen. Any list source you don’t fully control.
• Forms under bot attack. If you’re seeing bursts of junk sign-ups, DOI stops them reaching your list (add a CAPTCHA-style check on the form too).
• German subscribers (see below).
• Deliverability recovery. If you’re rebuilding reputation after a spam-folder problem, a DOI list is the cleanest possible base. Pair it with the steps in our deliverability guide.
• SMS. Klaviyo’s guidance is to always use double opt-in for SMS lists, noting carriers often require it.

When single opt-in is the better call

• A standard DTC pop-up with a welcome discount. The biggest revenue in most accounts comes from the welcome flow in the first hours. Adding friction here costs real money, and the list-quality risk is manageable.
• Checkout opt-ins. A customer who just placed an order has given you a working address. Confirmation adds nothing.
• Account creation. The address is already verified by the account flow.

If you run single opt-in, run it well: validate addresses at the form, suppress hard bounces automatically, and clean the list on engagement with a sunset flow so non-engagers don’t accumulate.

---

When double opt-in is legally required

Germany. German unfair competition law requires prior express consent for email advertising, and the sender bears the burden of proving it. In 2011, Germany’s Federal Court of Justice (case I ZR 164/09) accepted double opt-in as a method of documenting email consent, and German courts have treated single opt-in as insufficient proof because anyone can type anyone’s address into a form. In practice, if you market to German customers, use DOI for them and keep the confirmation records. Keep the confirmation email itself plain: a confirmation request, not a sales email.

Elsewhere in the EU. GDPR doesn’t mandate DOI, but Article 7(1) requires you to be able to demonstrate consent. DOI is the most robust evidence you can have.

Australia, the US, Canada and the UK. No statutory DOI requirement. Australia’s Spam Act, Canada’s CASL and the UK’s PECR all require consent (the US doesn’t), and all of them are satisfied by a clear, unticked sign-up checkbox or form, provided you record it. Our email marketing laws guide compares the consent rules country by country, and our CAN-SPAM guide covers the US.

---

How to set up double opt-in in Klaviyo

This reflects Klaviyo’s help centre documentation as of September 2026.

1. Check or change a list’s opt-in setting

In Klaviyo, open Lists & segments, choose the list your forms feed, then go to Settings and Consent. Tick Single opt-in to turn DOI off, or leave it unticked for double opt-in. New lists use your account’s default opt-in setting, so check it before you build new forms.

2. Customise the confirmation email and pages

Each double opt-in list has consent pages: the subscribe page, the confirmation email, and the success page shown after someone confirms. Brand all three. For the confirmation email:

• Subject line: make the action obvious (“Confirm your email to get your 10% code”).
• One button, above the fold. Nothing else competing for the click.
• Say what they’ll get and how often.
• Keep it free of promotional content, especially for German subscribers.

3. Tell people to check their inbox

Your form’s success message should say: “Check your inbox to confirm. Your code is waiting.” If you don’t, people assume they’re done and never confirm.

4. Deliver the incentive after confirmation

In Klaviyo, only confirmed subscribers are added to a DOI list and queued for a list-triggered welcome series. Use that. Put the welcome discount in the first welcome email, not on the form’s success screen, so the incentive gives people a reason to confirm. Our welcome series framework covers what comes next.

5. Know the edge cases

• Confirmation links are valid for 72 hours. After that, the person has to sign up again.
• List imports don’t trigger DOI. Importing a CSV adds people directly. Only import contacts with documented consent.
• Profiles can exist before confirmation. Klaviyo creates a profile when someone submits a Klaviyo form, even if they never confirm. They just aren’t subscribed or on the list.
• Third-party forms and API sign-ups behave differently. Klaviyo says profiles from these sources only sync to the list once confirmation is complete. Test any integration end to end.
• Region-specific setup. If you only need DOI for German visitors, one approach is a dedicated DOI list fed by a form targeted to German visitors, with the rest of the world on single opt-in.

6. Make sure the confirmation email arrives

A confirmation email in spam is a lost subscriber. Send from a branded, authenticated domain. Our DMARC, SPF and DKIM guide walks through it, and you can check your records with our free deliverability checker.

---

Our default recommendation

For most DTC brands: single opt-in for on-site pop-ups and checkout, double opt-in for SMS, giveaways, partner sources and German subscribers, with engagement-based suppression cleaning up behind you. That’s the combination that protects both the welcome flow revenue and the sender reputation.

If you’d like your sign-up forms, consent settings and welcome flow set up to match, that’s part of our Klaviyo setup service. Or grab a free Klaviyo audit and we’ll tell you whether your current setup is leaving revenue or reputation on the table.

This article is general information, not legal advice.