Double opt in email required on forms with "Consent checkboxes for communications and processing"?

[RKallok]

Hello!

My company does a lot of business internationally; we have GDPR and double opt-in in place.

I noticed while updating some forms, there is a form element called "GDPR options" and we've been using "Legitimate interest".

If we switch from "Legitimate interest" to "Consent checkboxes for communications and processing", would that mean there is no need for an opt-in email since they are consenting at that time?

If so, what would I need to do to get the form to not then send the double opt-in email? 

I hope this all makes sense, I'm super confused about all of this. Thanks!

[karstenkoehler · Accepted solution]

Hi @RKallok,

I'll preface my reply by saying that it does not constitute legal advice. You should always consult a legal professional when in doubt.

The double opt-in is, in my opinion, named in a very misleading way. It's not about opting in twice, it's a confirmation of an email address by a contact. That's also why HubSpot stores this information in a property called Marketing email confirmation status.

The GDPR options in the form, especially the consent box, are stored in HubSpot subscriptions. This refers to the consent of a contact to receive certain communications.

An email address can be confirmed without an active subscription opt-in. Vice versa, a contact can opt-in without confirming their email address. The double opt-in and the consent are two different things.

For example, in some countries (e.g. Germany) a contact can submit a form to receive a whitepaper without providing consent. However, they must confirm their email address before they can receive the whitepaper via email. Beyond this whitepaper email, further marketing communication would not be allowed.

As another example, a person might check the consent box for marketing communications but not confirm their email address (double opt-in). While they are eligible to receive marketing emails, in some countries their contact record must be deleted as it has not been confirmed.

For the exact consent notice text and regulations around email confirmation, I'd recommend consulting a legal professional.

In any case, I hope I was able to clarify the difference between the concepts.

Best regards!

[RKallok]

Thanks for breaking down everything, very helpful!