Double Opt-In and CASL: Is It Required for Canadian Email Marketing?

Double opt-in is often recommended in Canada as "best practice" for CASL compliance — but is it actually required? The answer is nuanced: CASL doesn't legally require double opt-in, but it provides the strongest available evidence of consent. Here's when you need it, when you don't, and how to implement it effectively.

Last updated: April 2026

What Is Double Opt-In?

Single opt-in: A person submits a form with their email address. They're immediately added to your list. No further confirmation required.

Double opt-in (confirmed opt-in): A person submits a form. They receive a confirmation email. They must click a link in that email to confirm their subscription. Only then are they added to your active marketing list.

The "double" refers to two actions: (1) submitting the form and (2) clicking the confirmation.

Is Double Opt-In Required Under CASL?

No — CASL does not require double opt-in. CASL requires that you have valid consent (express or implied) before sending a commercial electronic message. It does not prescribe a specific mechanism for obtaining that consent.

A properly configured single opt-in form — with an unchecked checkbox, clear consent language, a timestamp, and accurate records — satisfies CASL's express consent requirement.

So why is double opt-in so frequently recommended? Because it provides stronger evidence of consent — which matters if a recipient later claims they didn't sign up.

The CASL Evidence Problem

CASL enforcement can hinge on documentation. If the CRTC investigates a complaint about your email marketing, you need to demonstrate:

1. What consent was given
2. When it was given
3. The exact language the subscriber saw when consenting

The risk with single opt-in: Anyone can submit any email address to a form. If someone submits target@victim.com without that person's knowledge, your single opt-in records show consent that was never actually given by the intended recipient. If target@victim.com complains to the CRTC, you have a consent record — but no proof the actual owner of that email submitted the form.

Double opt-in solves this: The confirmation click comes from the email account owner's inbox. If they confirmed, they had access to that email account at that time. This is compelling evidence that consent was genuine.

Single Opt-In vs Double Opt-In: When to Use Each

Use Double Opt-In For:

High-volume or rapid-growth email programmes The more subscribers you add, the higher the probability that some addresses were submitted in error or fraudulently. Double opt-in filters these out automatically.

B2C consumer marketing Having double opt-in as default for consumer marketing provides meaningful protection.

Valuable subscriber relationships Double opt-in subscribers are higher intent — they took two actions to subscribe.

List rebuilds or platform migrations When importing contacts from another system, double opt-in verification confirms the existing consent is still valid.

Single Opt-In (With Careful Documentation) May Be Acceptable For:

In-person events and point-of-sale sign-ups When someone physically provides their email address in person (at a trade show, in your store), there's little risk of fraud. The person present is the account owner. Single opt-in with documented location/context is reasonable.

Existing customer relationships If you're capturing marketing consent at checkout alongside a purchase, the transaction provides strong context for the email address. Single opt-in with the purchase record as corroborating evidence is defensible.

B2B environments with low complaint risk B2B marketing in professional contexts carries different risk profiles than B2C consumer lists.

How to Implement Double Opt-In

Mailchimp

1. Go to Audience → Manage Audience → Settings → Audience name and campaign defaults
2. Enable "Enable double opt-in"
3. Customize the confirmation email subject and message in Audience → Signup forms → Form builder → Signup confirmation email

Mailchimp's default confirmation email is plain and functional. Consider customizing it with your branding and a clear explanation of what they're subscribing to.

Klaviyo

1. Go to your List or Segment → Settings
2. Enable "Double opt-in"
3. Customize the confirmation email in your flows

Klaviyo has specific double opt-in email templates you can customize.

HubSpot

HubSpot's form confirmation functionality is:

1. Go to Marketing → Forms → Edit Form
2. Enable "Send a simple thank you email" (basic confirmation)
3. For a full double opt-in with list membership gated on confirmation, use a workflow: form submission → send confirmation email with a meeting link or token → list enrollment triggered by email click

HubSpot's native double opt-in is less straightforward than Mailchimp/Klaviyo — consider third-party forms or workflows.

The Confirmation Email Template

Your double opt-in confirmation email should:

• Have a clear subject: "Please confirm your subscription to [Business Name]"
• Briefly explain what the subscriber is confirming
• Include a prominent confirmation button/link
• State the confirmation link's expiry (typically 24-48 hours)
• Not include marketing content (this is a transactional confirmation)

Template:

---

Subject: Confirm your subscription to [Business Name]

Hi,

Please confirm that you'd like to receive marketing emails from [Business Name].

[Button: "Yes, subscribe me"]

If you didn't request this subscription, you can safely ignore this email.

This confirmation link expires in 48 hours.

---

[Business Name] [Address]

---

Handling Confirmation Click-Through Rates

Double opt-in reduces final subscriber conversion compared to single opt-in. This is partly:

• People who signed up by mistake (good — these weren't valid subscribers anyway)
• People who can't find the confirmation email (check spam, delayed delivery)
• People who changed their mind

To improve confirmation rates:

• Use a clear, recognisable subject line (not one that looks like spam)
• Add "whitelist" instructions on the thank-you page ("Add confirmations@yourcompany.com to your contacts to ensure delivery")
• Time your confirmation email for immediate delivery
• Make the confirmation button prominent and easy to click

Documentation You Must Keep

Whether using single or double opt-in, document:

• What consent language the subscriber saw at sign-up (save this text with version dates)
• Timestamp of form submission
• IP address (for fraud detection, not strictly required by CASL but useful)
• For double opt-in: Confirmation click timestamp

Store this documentation for at least 3 years after the last marketing send to that subscriber.

CASL Enforcement and Consent Evidence

Under CASL, the person alleging that consent was given has the onus of proving it (CASL, s. 13). Double opt-in creates an automatic audit trail that helps you meet that onus.

Frequently Asked Questions

Q: We have 10,000 single opt-in subscribers. Should we retroactively move them to double opt-in? A: Running a re-confirmation campaign is a best practice, but CASL doesn't require it for validly obtained single opt-in consent. If your sign-up forms were properly configured (unchecked boxes, clear consent language, timestamps), your existing single opt-in list is likely CASL compliant. A re-confirmation exercise would provide stronger documentation going forward.

Q: Double opt-in reduced our list by 30%. Isn't that a problem? A: The 30% who didn't confirm were either not interested in receiving emails or submitted bad addresses. They were never going to be good subscribers. A smaller list of genuinely engaged subscribers is more valuable than a larger list with low engagement and compliance risk.

Q: Can we turn off double opt-in for specific high-conversion flows? A: Technically yes — but be consistent in your documentation if you do. If you use single opt-in for some forms, ensure those forms have especially strong consent language and audit trail documentation.

---

Build a CASL-Compliant Email Programme From the Start

Canada Compliance AI helps Canadian businesses configure their email marketing for CASL compliance — from opt-in forms to consent documentation to ongoing list management.

Start your free trial today — CASL compliance built into your email marketing.

Related reading: What is CASL | CASL Email List Audit | Mailchimp CASL Compliance