Double opt-in — Confirmed consent handshake
Qué es Double opt-in?
Esta entrada está disponible actualmente solo en inglés.
Double opt-in is a two-step consent pattern: the recipient first submits a contact (a signup form, a keyword, a checkout checkbox) and then confirms the subscription with an affirmative reply to a confirmation prompt — typically a YES reply to a verification message or a click on a confirmation link. Only the second step converts the pending intent into a confirmed grant, which is why regulators and carrier reviews treat double opt-in as the strongest consent evidence a sender can produce.
More detail
A plain consent record states what was requested — the grant another system asserts. A double opt-in handshake adds a recorded second step: an affirmative reply, tracked per (contact, channel) pair, that promotes the consent from `pending` to a confirmed `opted_in` state. TCPA (CTIA §5.1.3 express written consent), GDPR confirmed-opt-in, and 10DLC campaign-review QA all grade the quality of opt-in evidence; a recorded double confirmation is proof-of-reply that a bare consent submission cannot supply on its own.
Because the second step is recorded rather than assumed, the handshake carries its own evidence trail: the confirmation prompt sent, the reply received, and the timestamp of the state change — the material a carrier audit or a complaint investigation asks for. A confirmation step that never resolves leaves the consent `pending`, and sends that require confirmed consent should treat pending as not-consented.
On Orbit the handshake is a managed flow over the compliance consent API: start a handshake for a (contact, channel) pair, the recipient confirms with an affirmative reply, and the consent state is read back as confirmed. A confirmed handshake records the affirmative reply but does not by itself make the send lawful — the sender remains responsible for the eligibility of the ask and the content of the first message.
Preguntas frecuentes
- Is double opt-in legally required?
- Rarely as a named mandate — but it is the evidence standard regulators and carrier reviews grade against. TCPA express written consent, GDPR confirmed-opt-in guidance, and campaign-review QA all treat a recorded confirmation as far stronger than a form submission alone, and some jurisdictions and carriers effectively expect it for marketing traffic.
- What happens if the recipient never confirms the second step?
- The consent stays pending and should be treated as not-consented for any send that requires confirmed consent. The pending intent is still recorded, so the recipient can be re-prompted, but the sender has no confirmed grant to rely on until the affirmative reply arrives.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.