How double opt-in works

Double opt-in adds a confirmation step between a contact expressing interest in your emails and that contact being added to your marketing list. This page explains what happens in each step, when you’d want to turn it on, and what its limits are.

The short version

When double opt-in is on for a signup source, a new contact receives a confirmation email before they’re added to your marketing list. If they click the magic link in that email within the configured window, their consent is recorded and marketing emails start. If they don’t click, they’re never added — and no marketing email is sent to them.

How it works

The confirmation flow

1. A contact signals interest — for example, by submitting a newsletter signup form or applying for membership.
2. MapleGather sends a confirmation email to the contact’s email address. The email contains a magic link with a one-time token.
3. If the contact clicks the link within the configured window (default: 7 days), MapleGather records the confirmation in the member’s consent history (a “Double opt-in confirmed” event). The contact is added to the marketing list.
4. If the contact doesn’t click the link within the window, their unconfirmed signup expires. No marketing email is ever sent to them.

What MapleGather captures

At the moment the contact confirms, the system records:

• The confirmation event in the consent log
• The policy version that was active when they confirmed — so if your policy changes later, auditors can see which policy governed this member’s consent

Configuring double opt-in per signup source

You can turn double opt-in on or off for each signup source independently in Settings > Email > Opt-in policy. The sources available at M1 are:

• Newsletter signup — for contacts who submit via a newsletter form (M1, with full form support in a future release). Default: double opt-in on.
• Member application — for contacts who go through the membership application flow. Default: double opt-in off (the membership application itself is the consent event).

The confirmation window

You can set how many days the magic link stays active (minimum 1, maximum 30, default 7). The window is configured in the Confirmation email settings section on the opt-in policy page.

If a contact clicks an already-confirmed link, the page shows “Already confirmed — see your preferences” without writing a duplicate consent row.

If you change the TTL after sending a batch of confirmation links, the existing links keep their original expiry. Only new signups after the change use the new TTL.

Why it works this way

Double opt-in gives you two things: a higher-quality list and a stronger compliance record.

A list where every contact has actively confirmed is more engaged and less likely to generate spam complaints. For newsletter signups in particular — where someone might enter any address they happen to think of — the confirmation step filters out typos and people who don’t actually want your emails.

Capturing the policy version at confirmation means your consent log is a tamper-evident record: you can show exactly what policy was in effect when any given member consented.

Double opt-in is off by default for member applications because the membership application itself is a deliberate, multi-field action — the implicit consent there is already stronger than a newsletter checkbox. Requiring an extra confirmation step would add friction to a process where you want high completion rates.

Edge cases and boundaries

• Manual additions: When you add a contact manually, no confirmation email is sent regardless of your double opt-in setting. You need to record consent on their behalf with attestation, or the contact can opt in themselves from their preferences page.
• Admin-on-behalf opt-in: An admin can record consent on a member’s behalf from the member’s Email preferences tab. This writes a ConsentEventLog row with source=admin_override and doesn’t send a confirmation email.
• Policy changes mid-flow: A contact who received a confirmation email under a TTL of 7 days can still confirm after you change the TTL to 3 days — their original 7-day window stays in effect.

Put it into practice

• View and manage member consent history
• How email consent and opt-out enforcement work
• Email consent categories reference