How to build an email list that respects GDPR: consent, double opt-in and list hygiene

This article is for information only and is not legal advice. The exact rules depend on your business, your country and your type of recipient. For your own situation, check with a lawyer or a data protection officer (DPO).

Why you start with consent, not with the sign-up form

A valuable email list is not the biggest one, but the one made up of people who are waiting for your messages. Legally, both the General Data Protection Regulation (EU) 2016/679 and the rules on electronic communications (the ePrivacy Directive, implemented in Romania by Law 506/2004) rest on the same idea: you do not send marketing messages to people who did not ask for them.

Consent is generally considered valid when it is freely given, specific, informed and unambiguous. In practice that comes down to four simple things. The person takes a clear action, such as ticking a box or pressing a button. They know exactly what they are signing up for. They can say no without losing access to something else they need. And they can withdraw as easily as they joined.

There is a purely practical reason to do it properly from day one. Addresses collected the right way tend to bring better engagement, fewer spam complaints and a healthier sending reputation. A list inflated with addresses gathered in a hurry often ends up in the spam folder, and it can damage delivery to your good subscribers as well.

The terms you will meet, in plain English

Consent is a person’s agreement to receive marketing messages, given through a clear action. Single opt-in means an address joins the list as soon as the form is submitted. Double opt-in means the person then receives an email with a confirmation link, and the address is activated only after they click.

A lead magnet is a free piece of content offered in exchange for an email address: a guide, a template, a checklist, a discount. Segmentation splits subscribers into groups by interest or behaviour so each group gets relevant messages. List hygiene is the regular removal of invalid addresses, inactive contacts and people who have asked to unsubscribe.

GDPR does not explicitly demand double opt-in in every situation, but it is one of the best ways to prove that an address really belongs to the person who signed up. And proof matters: if a subscriber or a regulator asks, you must be able to show when, where and for what that person subscribed.

How to build the list, step by step

The process below works for an online shop, a clinic, a service company or a blog. The steps are the same; only the offer changes.

1. Define the promise. Write one sentence saying what subscribers receive and how often, for example: “one email a week with three practical ideas for your shop”.
2. Choose your email platform and check where the data is stored, what data processing terms the provider offers, and whether it records consent and handles unsubscribes automatically.
3. Build the form with as few fields as possible (usually just the email address and, optionally, a first name), an unticked consent box and a link to your privacy policy.
4. Switch on double opt-in and write a short, clear confirmation email with one button.
5. Send a welcome email straight after confirmation: deliver what you promised, restate the frequency and show how to unsubscribe.
6. Record the source of every sign-up (page, campaign, offer). It helps with segmentation and with proof.
7. Measure and clean the list at fixed intervals, not only when problems appear.

For step 6 you can add UTM parameters to the links that lead to your forms. The UTM link builder in our Lab helps you write them consistently, so you can later see which channel brings in your best subscribers.

The sign-up form: what to write and what to avoid

The form is where consent is won or lost. The text next to the button should be readable by someone in a hurry, on a phone, without leaving any doubt.

Here is an example of acceptable wording (adapt it to your company): “I would like to receive weekly email tips about online marketing from [Company name]. I can unsubscribe at any time. See our privacy policy for details.”

• Unticked box. A pre-ticked box is not an active action by the person.
• One purpose, one consent. Do not bundle the newsletter with acceptance of order terms or with sharing data with third parties.
• No unfair conditions. If someone buys from you, do not make them accept marketing in order to complete the order.
• Few fields. The more data you ask for, the stronger your justification must be, and the lower your completion rate is likely to be.
• Declared frequency and content. If you promise one email a month and send daily, the consent no longer covers what you do.

For existing customers, the electronic communications rules allow, under certain conditions, promotion of products or services similar to those already bought, provided the customer was offered the chance to refuse when the address was collected and in every message. The conditions are strict, so check this route with a lawyer before relying on it.

Lead magnets that attract the right subscribers, not just many

A good lead magnet solves a small, specific problem straight away. An 80-page guide goes unread; a one-page checklist gets used the same day. Choose the offer according to what you sell, not according to what looks attractive.

Imagine an accounting practice. Instead of a vague “subscribe for updates”, it offers a printable tax calendar in exchange for an email address. The people who download it are exactly those interested in accounting services, so the list stays relevant.

Segmentation: relevance without collecting needless data

Segmentation is how you send fewer messages that fit better. You do not need complicated profiles; a few simple criteria are enough at the start.

Segments that work almost anywhere

• Sign-up source: someone who arrived from an article on a topic keeps receiving content on that topic.
• Stated interest: one optional question in the form (“What interests you most?”) handles segmentation without you guessing anything.
• Customers versus prospects: the two groups need different messages.
• Recent activity: subscribers who open and click versus those who no longer react.

Follow the principle of data minimisation: collect only what you will actually use. If you have no plan for dates of birth, do not ask for them. Also, if you segment on behaviour (clicks, pages visited), say so in your privacy policy. As the list grows, segments become the foundation of the essential email automations: welcome series, abandoned cart, win-back.

List hygiene: what to clean and when

Lists decay over time. People change addresses, lose interest and mark messages as spam. Without cleaning, your metrics slip gradually and your emails reach the inbox less and less often.

A minimum routine, once a quarter

• Remove permanent bounces (hard bounces), addresses that do not exist and obvious typos.
• Honour every unsubscribe or spam complaint immediately; never send marketing to that address again.
• Identify subscribers who have neither opened nor clicked within a period you set (many senders choose somewhere between six and twelve months, depending on frequency) and send them a re-engagement campaign with one clear call to action.
• Remove from marketing anyone who does not respond even to that.
• Update proof of consent for older addresses imported from other systems.

Mind one technical detail as well. Since 2021, some email apps (Apple Mail, through its Mail Privacy Protection feature) load images automatically, which can inflate open rates artificially. Use clicks and replies as more reliable signals. For delivery, set up SPF, DKIM and DMARC correctly on your sending domain. Gmail, Yahoo and Outlook apply stricter rules to bulk senders (above roughly 5,000 messages a day to their users): authentication with SPF, DKIM and DMARC, one-click unsubscribe and a spam complaint rate kept below 0.3%. The details change, so check current requirements in the providers’ own documentation.

Common mistakes that wreck a list (and can cost you)

• Buying or renting lists. The people on them never gave consent to you. The result is complaints, a shaky reputation and legal risk.
• Adding contacts manually because they handed you a business card or wrote to you once. A conversation is not a newsletter subscription.
• Importing your customer address book into the email tool with no clear legal basis and without informing the people concerned.
• No proof. You cannot show when and how someone signed up, so you cannot defend your list if challenged.
• A hidden unsubscribe link, or one that demands a login, a password or a written confirmation.
• Rare sending, then sudden floods. A list left untouched for months that suddenly receives a burst of campaigns produces complaints.
• Misleading subject lines. A headline that promises something the email does not deliver costs you subscribers’ trust; see our guide to email subject lines and open rates.

How we go about it

When we set up a list for a client, we start with the consent flow, not the newsletter design: form, confirmation email, welcome message and unsubscribe page. Only then do we think about segments and automations. We record the source of every sign-up and keep the history somewhere it can be exported.

We do not promise the number of subscribers you will have after a month; that depends on the offer, the traffic and the niche. What we can promise is a sound foundation to build on. If you would like help, see our email marketing and automation service or write to us on the contact page. For the data collected through your website, it is also worth reading the guide to GDPR and cookies on your website.

In short

• Collect addresses only from people who actively sign up through a clear form.
• Double opt-in helps you prove consent and avoid wrong addresses.
• Offer a lead magnet that attracts people who fit what you sell.
• Segment simply and collect only the data you use.
• Clean the list regularly and honour unsubscribes at once.
• For specific legal situations, ask a lawyer or a DPO; official sources are on the website of the Romanian data protection authority.