Consent
A clear, informed yes to marketing (rules vary by country) — silence or pre-ticked boxes are usually weak.
Say it out loud
“We can prove this person asked for our email, what they were shown, and when.”
Consent is permission, and its quality is what gets tested. A regulator does not ask whether a flag is true in your database; it asks what the person saw, when they saw it, and whether agreeing was a free choice. Bundling marketing into “I agree to the terms” is a classic fine pattern in Europe.
Where, exactly. Not “website”.
The literal text shown. This is the field almost nobody stores, and the only one that settles an argument.
A pre-ticked box is not consent in the EU or UK. Storing that it was unticked is the proof.
To the second, in UTC. “March 2026” is not a record.
The confirmation click, if you use one.
Six fields. Most platforms store one boolean, which proves nothing when someone asks.
Yours
Nobody does this for you.
What goes wrong
Storing `marketing_opt_in = true` and nothing else. It is not evidence of anything: it cannot show what the person read, whether the box was pre-ticked, or whether marketing was bundled into a terms acceptance. The day you need it is the day you find out.
What people get told
The claim. “GDPR requires double opt-in.”
Actually. It does not contain the phrase. It requires consent you can demonstrate, and a confirmation click is simply the cheapest way to demonstrate it. German court practice is why the habit is near-universal in the DACH region.
Not the same as
- Opt-out
- Consent is permission before you send. Opt-out is the exit after you have.
- A legitimate interest assessment
- For marketing email to individuals in the EU, legitimate interest does not substitute for consent.
The dated rules behind this
A definition is not a citation. These are the pages with the primary source, the date it was published, and what to do about it.
See also
Where this sits
Stop 1, you get the address. Someone hands you an email address, and the terms of that handover decide everything after it.