Email opt-in confirmed via double opt-in or clear record

GDPR Art. 7 requires that consent be demonstrable — 'freely given, specific, informed, and unambiguous.' Sending marketing email to all registered users with no separate opt-in step fails the 'specific' and 'unambiguous' requirements for EU residents. CASL Section 10 requires either express or implied consent, and implied consent has strict time limits (24 months) and relationship conditions. Beyond legal exposure, no-opt-in flows produce high spam complaint rates because users who didn't choose to receive marketing email treat it as spam — complaint rates above 0.1% cause major providers to throttle or block the sending domain.

Implement a double opt-in flow: record a pending subscription, send a confirmation email, and only activate the subscription on confirmation click.

// Step 1: record pending + send confirmation
await db.pendingSubscription.create({
  data: { email, confirmToken: crypto.randomUUID(), expiresAt: addHours(new Date(), 48) },
})
await sendEmail({
  to: email,
  subject: 'Confirm your subscription',
  html: `<a href="https://example.com/api/newsletter/confirm?token=${token}">Confirm</a>`,
})

// Step 2: activate on confirmation click
await db.subscriber.upsert({
  where: { email: pending.email },
  create: { email: pending.email, confirmedAt: new Date(), optInSource: 'double-opt-in' },
  update: { confirmedAt: new Date() },
})

At minimum for single opt-in: record consentedAt, optInSource, and ipAddress for every subscriber at the point of signup. Without this audit trail, you cannot demonstrate consent under GDPR.