# GDPR and email collection: form, proof and hygiene

> A badly worded sign-up form makes a whole database unusable. What to display, what to keep as proof, and what has changed since February 2024.

- Original page: https://dotsland.com/en/gdpr-email-collection-form-proof-hygiene/
- Language: en
- Published: 2026-07-08T15:53:10+02:00
- Updated: 2026-10-19T17:57:26+02:00
- Section: Digital Marketing
- Publisher: Dotsland, https://dotsland.com/en/

---

## In brief

- **In B2C, no email prospecting without prior consent.** Unticked box, written purpose, identity of the data controller visible at the moment the person confirms.
- **In B2B, prior consent is not required, but information and the right to object still are.** Provided the message relates directly to the recipient’s job.
- **What counts in an inspection is proof, not a statement.** Date, source, and above all the exact wording displayed on the day of collection.
- **Clean collection is also a deliverability matter.** Since February 2024, Gmail and Yahoo require one-click unsubscribe and a low complaint rate: below 0.10% at Gmail, never reaching 0.30%, the single threshold Yahoo uses.

A small business sends us an export of 38,000 addresses, asking why its campaigns end up in spam. The answer comes down to a count: about 11,000 contacts come from an identifiable form, the others have no trace of origin.

Nobody can say what text these people clicked on. The file is not only risky, it is unusable: there is no way of knowing who you are allowed to write to. The problem rarely comes from sending, it comes from collection.

To be clear on scope: your site’s audience measurement falls under other rules, with exemption cases we cover in our article on [audience measurement without consent](https://dotsland.com/en/audience-measurement-without-consent/). Here, we are only talking about email.

## B2C and B2B: two regimes for the same channel

In France, email prospecting does not fall under the GDPR alone: it is governed by Article L34-5 of the French Post and Electronic Communications Code, read together with the guidance of the CNIL, the French data protection authority. That text distinguishes by the status of the recipient, not by the size of your business.

For a consumer, consent is collected before sending, unless they are already your customer and you are writing to them about products similar to those they bought. The telephone joined this regime on 11 August 2026: calling a consumer to sell them something now requires their prior agreement, and it is up to you to prove it, as we explain in our article on [cold calling and consent in France](https://dotsland.com/en/cold-calling-consent-france/).

For a professional reached at their work address, the CNIL accepts prospecting without prior consent if the subject of the message relates to their job. Writing to a purchasing director about purchasing software fits that framework. Offering them personal health insurance does not.

In both cases, information at collection and the right to object remain mandatory. This is not legal advice: if your growth relies on cold prospecting, have your set-up checked by a lawyer or a DPO.

*French regime for email prospecting (Article L34-5 of the Post and Electronic Communications Code, CNIL guidance), at 1 January 2026. Not a substitute for legal advice.*

| Situation | Prior consent | What remains mandatory |
| --- | --- | --- |
| Consumer, prospect | Yes, active and specific | Information, identity of the controller, withdrawal at any time |
| Consumer already a customer, similar product | No | Refusal offered at collection and in every email |
| Professional, named work address | No if the message concerns their job | Information at collection, objection, clear purpose |
| Generic address (contact@, info@) | No | Subject related to the organisation’s activity |

## What a compliant form actually contains

The forms we audit almost always fail on the same points: purpose not written, box pre-ticked or missing, controller not named, nothing about withdrawal.

A pre-ticked box is not consent: the Court of Justice of the European Union ruled so on 1 October 2019 in the Planet49 case. The person ticks, they do not untick.

The word “newsletter” on its own is not enough either. Say what the person will receive and how often, and provide a separate box if the address is to be passed on to a partner.

*Minimum structure of a sign-up form aimed at consumers.*

| Element | What we often see | What holds |
| --- | --- | --- |
| Purpose | “Sign up to the newsletter” | “Receive our advice and offers, about two emails a month” |
| Box | Pre-ticked, or missing with the line “by confirming, you accept” | Unticked, separate from acceptance of the terms of sale |
| Controller | Nothing | “Your data is processed by \[company name\]”, with a link to the privacy policy |
| Withdrawal | Nothing | “One-click unsubscribe in every email, or at \[contact address\]” |
| Fields requested | Last name, first name, phone, company, sector | The email alone if it is enough for the stated purpose |

Then there is data minimisation, the line people forget: each field must be justified by the stated purpose, and each one lowers your completion rate. We devote [a whole article to wording consent](https://dotsland.com/en/cookie-banner-design-and-wording/).

## Proof: the first thing you will be asked for

In the event of a complaint or an inspection, the question is not “do you have consent”, it is “show it”. Article 7(1) of the GDPR puts the burden of proof on you.

A screenshot of the current form proves nothing: it shows what is displayed today, not what the person read eighteen months ago. Hence the value of timestamping and versioning the wording. To keep, contact by contact:

- **The date and time** of the sign-up, and of the confirmation in double opt-in.
- **The source**: URL of the page, form identifier, or name of the offline event.
- **The exact wording** displayed that day, or the reference of the text’s version.
- **A technical trace**: submission identifier or IP address.
- **The history of withdrawals**: date of unsubscription and channel used.

Most email tools store the date and the source. Almost none store the wording: keep a log of the versions of your statements. As for duration, the CNIL uses three years from the last contact. This discipline turns your database into [first-party data you can genuinely use](https://dotsland.com/en/first-party-data-from-scratch/).

## Double opt-in: what it costs, what it brings

Double opt-in adds a step: the person signs up, receives a confirmation email, and only enters the database after clicking. The GDPR does not require it; it is simply the easiest way to produce solid proof and eliminate fake addresses. Its cost is measured in volume, its gain in deliverability.

*Orders of magnitude observed on our assignments, for guidance only and not as market benchmarks. Your gaps will depend above all on your traffic source.*

| Indicator | Single opt-in | Double opt-in |
| --- | --- | --- |
| Contacts in the database per 100 sign-ups | 100 | 60 to 80 |
| Hard bounces on the first send | 2 to 6% | under 1% |
| Open rate over the first three months | index 100 | index 130 to 160 |
| Spam complaints | can approach the 0.30% breaking point | generally under 0.1% |
| Nature of the proof | declarative | timestamped, confirmed by a click |

The trade-off arises when volume is low: below a few hundred sign-ups a month, losing a third of contacts is felt. In that case keep single opt-in, take care of the logging, and trigger a welcome email that serves as a trace and a validity test. It is also [the first automation scenario to set up](https://dotsland.com/en/marketing-automation-where-to-start/).

## Three practices that destroy a database

A purchased file is not transferable: consent is given to an identified data controller, for a stated purpose. It cannot be resold, unless there is a separate box mentioning transfer to third parties, which is rare.

Scraping addresses from websites, professional networks or directories raises the same problem, made worse by the complete lack of information given to the people concerned. The CNIL has fined several data brokers and competition publishers for forms that did not allow specific consent.

Reusing a database for another purpose is more insidious, because it is done in good faith: addresses collected for order tracking cannot be used for a promotional campaign without a separate legal basis. We broaden the subject in our article on [the GDPR in day-to-day marketing](https://dotsland.com/en/gdpr-day-to-day-marketing/).

> **The mistake not to make**  
> Loading an external file into the tool that already sends your legitimate campaigns. Complaints are charged to your sending domain, not to the imported file: you damage your clean lists, and a domain’s reputation takes several months to rebuild.

## Hygiene after collection

Since February 2024, Gmail and Yahoo have applied inbox access rules, gradually rather than all at once. The baseline applies to everyone: SPF or DKIM authentication. At Gmail, above 5,000 messages a day, DMARC is added, along with one-click unsubscribe honoured within two days and a complaint rate kept below 0.10% without ever reaching 0.30%. Yahoo applies the same principles but publishes no volume threshold and uses a single complaint threshold of 0.3%. Microsoft introduced a 5,000-messages-a-day threshold in May 2025 for authentication only. Since November 2025, Gmail has been tightening enforcement: temporary rejections, then permanent ones.

These requirements are not legal ones, but they converge with the GDPR: writing to people who did not ask for it comes at a price. The penalty is not a fine, it is the spam folder. Three routines are enough to keep the database healthy: process hard bounces at the first permanent failure, remove inactive contacts from sends after twelve months and one re-engagement attempt, and test the unsubscribe link yourself every quarter.

> **What to remember**  
> Compliance and deliverability are repaired with the same actions: a clear form reduces complaints, an easy unsubscribe avoids the “spam” click, and a cleaned database lifts the open rate, and therefore inbox placement.

## Your collection compliance checklist

To run on every entry point: newsletter, pop-in, checkout, contact form, trade show.

1. **List the entry points**, manual spreadsheet imports included.
2. **Check the box and the purpose**: unticked box, content and frequency stated, one box per purpose.
3. **Name the data controller** and link the privacy policy.
4. **Start a log of wordings**: one line per version, with the date it went live and a screenshot.
5. **Check what your tool stores** per contact: date, source, status, unsubscription history.
6. **Isolate contacts with no identifiable origin**: sends suspended, then re-consent or deletion.

## Frequently asked questions

### Can you send a prospecting email to a work address without consent?

In France, yes in most cases, if the message relates directly to the person’s job. They must be informed at collection and be able to object in every message. This tolerance covers neither personal addresses nor offers unrelated to their work.

### Is double opt-in mandatory under the GDPR?

No. The GDPR requires consent that is freely given, specific, informed and unambiguous, and the ability to demonstrate it. Double opt-in is only one way of producing that proof, the most reliable. A well-logged single opt-in remains acceptable.

### How long should you keep a contact who never opens your emails?

The CNIL uses three years from the last contact as a benchmark. In practice, a contact inactive for twelve months brings in nothing and weighs on your deliverability: remove them from sends after a re-engagement attempt.

### What should you do with an inherited database of unknown origin?

Do not use it as it is. Two options: delete it, or try a single re-consent campaign. That remains a solicitation: send it from a subdomain separate from your usual campaigns, then delete those who do not respond.

### Can a single box cover the newsletter and sharing with partners?

No. Consent must be specific to each purpose: two purposes call for two separate boxes, each unticked by default. Grouping them weakens the whole, including the newsletter you could easily have secured.

## Where to start this week

Open your main sign-up form and read it as a visitor would: what will they receive, who processes their data, how do they withdraw. If any of the three answers is missing on screen, you have your first workstream.

Then export your database and count the contacts whose origin you cannot state. That figure measures the real state of your collection and shapes the rest of your [email marketing strategy](https://dotsland.com/en/expertise/email-marketing-gdpr/).

**Unsure whether your email collection is compliant?** We always start with the same exercise: an inventory of entry points, a reading of the wording actually displayed today, and a count of contacts with no traceable origin in your sending tool. [Let’s talk](https://dotsland.com/en/contact-us/).