{"id":15971,"date":"2020-10-23T09:53:43","date_gmt":"2020-10-23T08:53:43","guid":{"rendered":"https:\/\/www.rosello-mallol.com\/rgpd-y-doble-opt-in-para-empresas-es-obligatorio\/"},"modified":"2021-08-03T09:27:13","modified_gmt":"2021-08-03T08:27:13","slug":"rgpd-and-double-opt-in-for-companies-is-necessary","status":"publish","type":"post","link":"https:\/\/www.rosello-mallol.com\/en\/rgpd-and-double-opt-in-for-companies-is-necessary\/","title":{"rendered":"GDPR and double opt-in for email marketing campaigns: Is it required?"},"content":{"rendered":"\n

The need for double opt-in for email marketing campaigns in companies to comply with the GDPR is a recurring question from a lot of clients; many of them spend days finding a tool for their campaigns that allows for double opt-in.<\/p>\n\n\n\n

Is double opt-in <\/strong>for company email marketing necessary?<\/strong><\/h2>\n\n\n\n

The answer is plain and simple: no. <\/p>\n\n\n\n

With the approval of the GDPR (in May 2018), it became mandatory for the consent to process personal data (also for email marketing campaigns) to be explicit. <\/p>\n\n\n\n

In other words, a positive action or explicit confirmation from the recipient of the commercial email was needed in order to carry out the campaigns. <\/p>\n\n\n\n

However the GDPR does not mention anywhere that this opt-in (or explicit consent) must be doubled. This system normally implies double acceptance:<\/p>\n\n\n\n

  1. First opt-in: in the email registration process (with a check box). <\/li><\/ol>\n\n\n\n
    1. Second opt-in: by accepting the subsequent confirmation email.<\/li><\/ol>\n\n\n\n

      Although this system can be useful, let\u2019s be clear about this: you will never receive a penalty if the registration system in your Newsletter or email marketing campaigns does not include a double verification or double opt-in system.<\/p>\n\n\n\n

      Double opt-in: So what does the GDPR require?<\/strong><\/h2>\n\n\n\n

      Before answering this question, it must be indicated that the GDPR is “technologically neutral”, which means, it never suggests, much less imposes, a specific technology. The GDPR tells you “make sure you do this” but does not tell you “how to do it”, as long as you get the former done.<\/p>\n\n\n\n

      Having clarified this, what the GDPR does require in relation to consents is:<\/p>\n\n\n\n

      1. It must be explicit (we have already seen this). <\/li>
      2. Whoever collects the data (the company) must have proof of this consent. In the words of the GDPR “Where processing is based on consent, the controller shall be able to demonstrate<\/strong> that the data subject has consented to processing of his or her personal data\u201d<\/em><\/li><\/ol>\n\n\n\n
        \"P\u00e1gina<\/figure>\n\n\n\n

        How do I have proof of consent<\/strong> (with and without the double opt-in)?<\/strong><\/h2>\n\n\n\n

        The obligation to have sufficient proof of consent in your email marketing campaigns can be fulfilled in different ways:<\/p>\n\n\n\n