# Regulatory Standards — Implementing Double Opt-In Email

## Primary Regulations

### ePrivacy Directive 2002/58/EC (as amended by 2009/136/EC)

- **Article 13(1)**: "The use of automatic calling and communication systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may be allowed only in respect of subscribers or users who have given their prior consent."
- **Article 13(2)**: Soft opt-in exception — where a person obtains electronic contact details in the context of a sale, the same person may use those details for direct marketing of similar products or services, provided the customer was given a clear and free opportunity to opt out at the time of collection and in every subsequent message.
- **Article 13(4)**: Prohibits the practice of sending electronic mail for direct marketing disguising or concealing the identity of the sender and without a valid return address.

### GDPR — Regulation (EU) 2016/679

- **Article 7(1)**: Controller must demonstrate consent — DOI provides verifiable proof.
- **Article 7(3)**: Withdrawal must be as easy as giving consent — one-click unsubscribe in every email.
- **Article 5(1)(a)**: Lawfulness, fairness, and transparency in processing.

### CAN-SPAM Act (15 U.S.C. 7701-7713)

- **Section 7704(a)(3)(A)**: Commercial electronic mail must include a functioning opt-out mechanism.
- **Section 7704(a)(3)(B)**: Opt-out requests must be honored within 10 business days.
- **Section 7704(a)(5)**: Must include valid physical postal address of the sender.
- **Section 7704(d)**: Prohibition on harvesting email addresses or generating addresses through dictionary attacks.
- Note: CAN-SPAM does not require opt-in but DOI is best practice for GDPR-compliant organizations serving US users.

### Canadian Anti-Spam Legislation (CASL) — S.C. 2010, c. 23

- **Section 6(1)**: No person shall send or cause to be sent a commercial electronic message unless the person has consent and the message complies with form requirements.
- **Section 10(1)**: Express consent — person clearly agrees to receive messages.
- **Section 10(9)**: Implied consent from existing business relationship (limited to 2 years after last purchase).

## Case Law

### German BGH VI ZR 269/12

The German Federal Court of Justice established double opt-in as the standard for demonstrating email marketing consent. A single opt-in without confirmation was held insufficient to prove consent.

### CJEU C-673/17 — Planet49

While primarily about cookie consent, the principles apply to email: pre-ticked checkboxes for marketing communications do not constitute valid consent.

## Supervisory Authority Guidance

### CNIL Guidelines on Commercial Prospecting (March 2022)

- Opt-in consent required before sending commercial emails to individuals (B2C)
- B2B prospecting allows soft opt-in when the message relates to the recipient's professional role
- Consent records must include: date, time, consent text, channel, and proof of affirmative action

### ICO Direct Marketing Guidance (UK, October 2020)

- Consent for electronic marketing (email, SMS, automated calls) must be freely given, specific, informed, and unambiguous
- DOI is recommended as best practice for demonstrating consent
- Soft opt-in available for existing customers for similar products/services