Double opt-in or single opt-in for a SaaS waitlist or newsletter
Use double opt-in when bots, typos or consent proof are a real risk, and single opt-in plus CAPTCHA when they are not. Here is how a small SaaS team decides.
On this page(10 sections)
- What is the real difference between single and double opt-in?
- Does GDPR or Gmail require double opt-in?
- When should a SaaS use double opt-in?
- When is single opt-in fine?
- How much does double opt-in cost in signups?
- What makes a good confirmation email?
- What should you store as proof?
- What about people who never confirm?
- A setup that works for most small SaaS teams
- Bottom line
Double opt-in means a new subscriber must click a link in a confirmation email before you add them to your list. Single opt-in adds them the moment they submit the form. For a SaaS waitlist or newsletter, neither is always right: double opt-in is the safer default when you will email the list later, and single opt-in with bot protection is fine when the form is low-risk and you want every signup you can get.
This post gives you a way to choose, what each option costs, and a setup that keeps most of the benefit of both.
What is the real difference between single and double opt-in?
In single opt-in (SOI), submitting the form is the whole consent step. In double opt-in (DOI), the form only starts the process: you send one email, and the address joins your list only after the owner clicks the link inside it.
| Single opt-in | Double opt-in | |
|---|---|---|
| Address added | Immediately | After the confirmation click |
| Typos and fake addresses | Land on your list | Never confirm, so never join |
| Someone signing up a stranger | Works | Stranger gets one email, then nothing |
| Signup count | Highest | Lower (people forget to click) |
| Proof the owner agreed | Weak | Stronger (a log of the confirmation) |
| Extra work | List cleaning later | A confirmation email to build and monitor |
The confirmation email is also the first message your domain sends to that person, so it tells mailbox providers something about you. A clean first message to a real, engaged person is a good start.
Does GDPR or Gmail require double opt-in?
No. Neither requires it by name, though both push you toward confirming addresses.
The GDPR asks for consent that is freely given, specific, informed and unambiguous, and for you to be able to show it. A clear form with no pre-ticked box can meet that without a confirmation step, which is also how Litmus describes it. Some national rules and regulators are stricter, so if you collect signups in a country where you are unsure, check with a lawyer. This post is not legal advice. For the wider picture, see email and GDPR for a small company.
Google's sender guidelines tell senders to make sure recipients opt in and to confirm each address before subscribing it, and to avoid pre-ticked forms. They also set a spam-rate ceiling: keep the rate reported in Postmaster Tools below 0.3%, and aim for under 0.10%. People who never asked for your email are the main source of spam reports, which is the practical argument for confirmation.
When should a SaaS use double opt-in?
Use double opt-in when at least one of these is true:
- You will email the list in bulk. A launch announcement to 3,000 unconfirmed addresses is how a new domain gets a bad first week.
- Your form is public and easy to find. Bots look for pages with "subscribe" or "newsletter" in the URL. Litmus reported more bot signups and fake addresses on its newsletter form and moved that one form to double opt-in, while leaving its other forms on single opt-in.
- Typos matter. A waitlist address entered as
gmial.comis a lost customer. Confirmation catches it on day one, while the person is still on your site. - You operate in a place where proof of consent matters. A stored confirmation record is easier to defend than a form submission.
- Someone could be signed up against their will. Without confirmation, anyone can enter anyone's address. That is also the mechanism behind subscription bombing, where your form is used to flood a victim's inbox with welcome emails.
When is single opt-in fine?
Single opt-in works when the address is already proven or the risk is low:
- The person is a signed-in user who verified their email at signup and is ticking a box for product updates.
- The form sits inside a flow where a bad address hurts the person, not you, such as a download that is emailed to them. They have every reason to type it correctly.
- You are validating an idea and a smaller, cleaner list would mean fewer data points. Plan to clean the list before the first real send, or switch the form to double opt-in before you send anything large.
Even then, pair single opt-in with protection: a honeypot field, a rate limit per IP, and a CAPTCHA or similar challenge. On its own, SOI is the setting most open to abuse, and disposable addresses are the most common sign.
How much does double opt-in cost in signups?
It costs some signups, and nobody can give you your number in advance. Vendor blogs quote losses anywhere from a fifth to well over a third of signups, but those figures come from marketing pages, not controlled studies, so treat them as soft. What you lose are people who forget, whose message lands in spam, or who change their mind. For a waitlist, many of them were never going to become customers.
The way to know is to measure your own confirmation rate: confirmed addresses divided by submitted ones, over 48 hours. If it is very low, the problem is usually the confirmation email (slow, landing in spam, vague subject), not the idea of confirming.
What makes a good confirmation email?
A confirmation email has one job, so keep it to that:
- Subject that says what to do: "Confirm your email to join the waitlist."
- Sent within seconds, from a recognizable address on your own domain, with working SPF, DKIM and DMARC.
- One button and one plain link, in the first screen of the message.
- One sentence about what they signed up for and how often you will write.
- No marketing content. Selling in a confirmation email makes it look like a promotion.
- A line for the wrong person: "If this wasn't you, ignore this email and we won't write again."
The link needs care too. Some security scanners open links before people do, which can confirm an address nobody confirmed, or burn a single-use link. A two-step design avoids both; see confirmation links that survive email security scanners.
What should you store as proof?
For each confirmed address, keep a small record:
email: [email protected]
list: product-waitlist
form_url: https://example.com/waitlist
signup_at: 2026-11-04T09:12:44Z
signup_ip_hash: (hash, not the raw IP, if you keep it at all)
consent_text: "Email me when the beta opens"
confirmation_at: 2026-11-04T09:13:30ZKeep the exact wording shown beside the form, because consent is tied to what the person agreed to. Store only what you need, and delete it when the person asks. Be aware that a click alone is not a perfect proof, since a scanner can produce one, which is another reason to use the two-step link.
What about people who never confirm?
Send one reminder about a day later, then stop. Do not add unconfirmed addresses to your list "just in case", and do not email them again next month. After about a week, delete the pending record. If they come back, they start over.
A setup that works for most small SaaS teams
- Waitlist or public newsletter form: double opt-in, with a honeypot and a rate limit.
- In-app "send me product news" checkbox: single opt-in, unticked by default, because the address was already verified.
- Customers who bought something: transactional email needs no opt-in, but marketing to them does.
- Review the choice every few months: if bot signups drop to nothing, you can relax a form; if complaints rise, tighten it. A waitlist you plan to announce a launch to is worth getting right. For what to send once they are in, see waitlist and beta invite emails.
Bottom line
Double opt-in is not a law, and it is not always worth the lost signups. Use it where bots, typos or proof of consent can hurt you, mostly on public waitlist and newsletter forms, and use single opt-in with protections where the address is already verified. Whichever you pick, write down your reasoning, measure the confirmation rate, and make the confirmation email fast, plain and easy to trust. If you want AI to help sort the replies and questions that come after signup, Koltrix can read, organize and draft in your inbox, and nothing is sent without a human click.
Start with Koltrix
Your domain, one inbox, and an API that sends.
A team inbox where AI sorts and drafts (nothing is sent without your click), plus the transactional API and SMTP relay your product sends with. 7 days free, no card.
