Email opt-in: what a valid sign-up says, and what you have to keep
The yes that lets you market to someone. Easy to collect, easy to get subtly wrong, and only worth what you can prove about it later.
- 096Opt-In
- When a user gives consent to receive emails from you, complying with regulations like GDPR and CAN-SPAM.
- UK standard
- Freely given, specific, informed, and a clear positive action
- Not valid
- Pre-ticked boxes, silence, or consent given to another company
- Keep on file
- The form wording, the date, and where the person signed up
- In the US
- Not required by CAN-SPAM, though an opt-out is
What makes an email opt-in valid in the UK
Here's the thing. Most opt-ins fail on wording, not on the box. The ICO's guide to electronic mail marketing says the person must have specifically consented to email from you, and that takes more than a tick.
- An action they take, like ticking an empty box or pressing a clearly labelled button
- Your shop's name, so they know who they're agreeing to hear from
- Email named on its own, separate from texts
- Nothing bundled into your terms, or made a condition of buying
- A record of the wording, the date and the form they used
None of this is legal advice. It's what we set up on accounts, checked against the regulator's own words.
Single, double and soft opt-in side by side
| Route in | What it lets you send | What to keep |
|---|---|---|
| Single opt-in | The marketing the form described | The wording, the date, the source |
| Double opt-in | The same, with proof the address owner agreed | All that, plus the confirmation click |
| Soft opt-in | Your own similar products, to people who bought or nearly bought | The order, and the opt-out you offered then |
The soft opt-in is the one people stretch. It covers your customers and your similar products, with an opt-out in every email, and that's all. Our post on the soft opt-in rules shows where the line sits.
Why CAN-SPAM doesn't ask for an opt-in
The US law works the other way round. CAN-SPAM lets you email first, as long as every message carries a working opt-out and a real postal address, and the FTC's compliance guide covers the rest.
So the American habit doesn't work on your UK list. Sell into both? Build to the UK standard and the consent question is settled for the US as well.
Related terms
FAQs
Is ticking a box at checkout a valid email opt-in?
If the box started empty and the wording named email marketing from your shop, yes. If it was ticked for them, it isn't consent. The soft opt-in may still let you email those buyers about similar products, provided they had a simple way to opt out at checkout and get one in every email.
Can we email people who opted in on another company's site?
No. Their consent has to name your shop and cover email, so a yes given to a partner, a sister brand or a list seller doesn't carry over. If you want those people, give them a reason to sign up with you directly, and record it when they do.
How do we prove someone opted in?
Klaviyo stores the consent status, the date and the method against each profile, which covers most of it. What it can't store is what your form said that day. Screenshot the form every time the wording changes and file it with the date. That pairing is your proof.
Rather we explained it on your own account?
Bring your Klaviyo account to a growth consultation. We'll walk through what this means for your numbers, in plain English, and what we'd fix first.
Half an hour with Theo, our founder.
We're all about relationships built on trust, mutual respect and a shared vision for success. If that sounds like your vibe, let's make some waves together 🌊
