Opt-In Forms: Collect Email and SMS Consent That Holds Up

An opt-in form is where a shopper agrees to receive your marketing. It looks like a design question (popup or footer, one field or two), but what it really produces is a consent, and the consent decides who you can email or text later. This guide covers where to place opt-in forms on an ecommerce store, how to word them for email and SMS, when to use double opt-in, and what to keep as proof.

What is an opt-in form?

An opt-in form collects a contact detail, usually an email address or a phone number, and the person's agreement to receive marketing on it. "Opt-in" means the default is no: nothing is sent until the person acts. The opposite, opt-out, means you send until they ask you to stop.

Which one applies depends on the law of the customer's country and the channel:

Sources: EUR-Lex; FTC; eCFR.4EUR-Lex, Directive 2002/58/EC (ePrivacy Directive), Article 137Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business5eCFR, 47 CFR 64.1200, Delivery restrictions (FCC rules implementing the TCPA)1EUR-Lex, Regulation (EU) 2016/679 (GDPR), Article 4(11), Article 7 and Recital 32

Even where email is opt-out, an opt-in form is how most stores build their list: it gives you a person who asked to hear from you, which helps both sales and deliverability. The rules on unsubscribe links and sender requirements are in how to avoid emails going to spam.

The GDPR defines consent as a "freely given, specific, informed and unambiguous indication" of the person's wishes, given "by a statement or by a clear affirmative action".1EUR-Lex, Regulation (EU) 2016/679 (GDPR), Article 4(11), Article 7 and Recital 32 Every rule below comes back to those words.

Types of opt-in forms and where they fit on a store

Each format catches a different moment. A store usually runs three or four, not one.

The last row matters more than it looks. An "email me when it's back" form gives you consent for that alert. Moving that address into your weekly newsletter needs its own opt-in, because the EDPB says consent covers the purpose it was given for, and separate purposes need separate consents.2European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1 (May 4, 2020)

Popups and Google's intrusive interstitials guidance

Popups collect the most sign-ups on many stores, and they're also the format most likely to annoy shoppers and search engines. Google Search Central describes intrusive interstitials as elements "that obstruct users' view of the content, usually for promotional purposes," and warns that they make it hard for Google and other search engines to understand your content, which "may lead to poor search performance."8Google Search Central, Avoid intrusive interstitials and dialogs (updated Dec 10, 2025)

Google's page gives three practical rules:8Google Search Central, Avoid intrusive interstitials and dialogs (updated Dec 10, 2025)

• Don't cover the whole page with an interstitial.
• Don't redirect the visitor to a separate page to collect their consent or input.
• Use banners that take up a small fraction of the screen instead. Google names newsletter sign-ups among the things these smaller containers can hold.

Legally required interstitials, such as an age gate, are exempt. Google still recommends overlaying them on the content rather than redirecting.8Google Search Central, Avoid intrusive interstitials and dialogs (updated Dec 10, 2025)

A popup on a product page competes with the add-to-cart button. If a shopper is already comparing sizes or reading ingredients, the sale matters more than the email. Test whether excluding product and cart pages from the popup costs you sign-ups or gains you orders.

The checkout consent box: separate and unticked

Buyers are the most valuable people to have on your list, and checkout is where you meet them. It's also where most consent mistakes happen, because the marketing question gets mixed with the purchase.

The EDPB, which coordinates the EU's data protection authorities, says the same in its consent guidelines: "The use of pre-ticked opt-in boxes is invalid under the GDPR," and consent "cannot be obtained through the same motion as agreeing to a contract or accepting general terms and conditions."2European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1 (May 4, 2020) The EU Court of Justice applied the rule in Planet49 (Case C-673/17, October 1, 2019): consent is "not validly constituted by way of a pre-checked checkbox which that user must deselect to refuse his or her consent."3Court of Justice of the European Union, Press release No 125/19, Judgment in Case C-673/17 Planet49 (Oct 1, 2019)

What this means on your checkout:

1. One box per channel. Email and SMS are different consents with different rules. The EDPB treats separate purposes as needing separate consents.2European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1 (May 4, 2020)
2. Unticked by default. Shopify lets merchants choose whether its checkout email box is preselected and in which regions, either manually or with "Regions recommended by Shopify," which it says keeps the setting in line with the customer's country.9Shopify Help Center, Collecting customer contact information If you sell to the EU, leave it unticked there.
3. The order doesn't depend on it. An unticked box must not block payment.
4. Plain wording next to the box. What you'll send, on which channel, and that they can unsubscribe at any time. The GDPR requires the request to be "clearly distinguishable from the other matters," in "clear and plain language."1EUR-Lex, Regulation (EU) 2016/679 (GDPR), Article 4(11), Article 7 and Recital 32

Emailing past customers without a checkbox

The EU has one exception for buyers. Article 13(2) of the ePrivacy Directive lets a seller who got a customer's email address in the context of a sale use it to market its own similar products, as long as the customer was given a clear, free and easy way to object when the address was collected, and again in every message.4EUR-Lex, Directive 2002/58/EC (ePrivacy Directive), Article 13 National laws implement it, so check the rule in each country you sell to. Outside that exception, Article 13(1) requires prior consent for marketing email.4EUR-Lex, Directive 2002/58/EC (ePrivacy Directive), Article 13

In the US, CAN-SPAM doesn't require consent for commercial email. It requires accurate headers, your postal address, a clear way to opt out, and opt-outs honored within 10 business days, with penalties of up to $53,088 per email in violation.7Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business Texts are different: see the next section. How the confirmation and receipt emails fit in, which don't need a marketing opt-in, is covered in payment confirmation email. The rest of the checkout sequence is in checkout flow, and guest buyers in checkout as guest.

SMS opt-in: TCPA consent and carrier rules

In the US, a marketing text sent with an autodialer to a mobile number needs the recipient's "prior express written consent."5eCFR, 47 CFR 64.1200, Delivery restrictions (FCC rules implementing the TCPA) The rule's own revocation paragraph applies it to "calls or text messages," so texts are covered.5eCFR, 47 CFR 64.1200, Delivery restrictions (FCC rules implementing the TCPA) The definition sets what the form must disclose.

The signature can be electronic or digital, to the extent federal law or state contract law recognizes it as a valid signature.5eCFR, 47 CFR 64.1200, Delivery restrictions (FCC rules implementing the TCPA) Two practical consequences: the SMS box at checkout can't be required to complete the order, and the wording must say so.

Carriers add their own rules on top. CTIA, the US wireless industry association, publishes the Messaging Principles and Best Practices that carriers apply. It asks every call-to-action to make clear the program or product description, the number or short code the texts come from, who is sending, any fees, and how to opt out, get help and read the privacy policy.6CTIA, Messaging Principles and Best Practices (May 2023) Opt-in details "should not be obscured in terms and conditions."6CTIA, Messaging Principles and Best Practices (May 2023)

Example SMS opt-in wording (US):

Text me offers and order updates from Northline. Recurring automated marketing messages, about 4 per month. Consent is not a condition of purchase. Msg and data rates may apply. Reply STOP to cancel, HELP for help. [Terms] [Privacy]

Then confirm. For recurring programs, CTIA asks for a confirmation text before any other message, with the program name, customer care contact or HELP instructions, how to opt out, that messages are recurring and how often, and any fees.6CTIA, Messaging Principles and Best Practices (May 2023)

Under 47 CFR 64.1200(a)(10), a consumer can revoke consent "by using any reasonable method," and the listed words sent in reply to a text count automatically. Revocation must be honored within a reasonable time, no more than ten business days.5eCFR, 47 CFR 64.1200, Delivery restrictions (FCC rules implementing the TCPA) A single confirmation text is allowed if it only confirms the revocation and contains no marketing.5eCFR, 47 CFR 64.1200, Delivery restrictions (FCC rules implementing the TCPA)

In the EU, texts follow the same ePrivacy rule as email: prior consent, with the same existing-customer exception.4EUR-Lex, Directive 2002/58/EC (ePrivacy Directive), Article 13 Choosing an SMS platform, 10DLC registration and campaign types are covered in SMS marketing for ecommerce and the SMS marketing glossary entry.

Inside Tagada

Build the funnel once, route every customer to the right offer

Checkout, upsells and subscriptions on one flow, with conditions per country, order or customer.

Start free

Single vs double opt-in

With single opt-in, the person is subscribed when they submit the form. With double opt-in (also called confirmed opt-in), they get an email with a link and are subscribed only after clicking it.

Neither the GDPR nor US law names double opt-in as a requirement. The GDPR asks you to obtain a valid consent and be able to prove it; the EDPB says "the GDPR does not prescribe exactly how this must be done."2European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1 (May 4, 2020) Double opt-in is one way to prove that the address belongs to the person who typed it. Shopify notes that for stores in Germany, activating double opt-in "can help you meet GDPR compliance requirements."9Shopify Help Center, Collecting customer contact information On Shopify, it's under Settings > Notifications > Customer notifications > Marketing double opt-in, and it covers both email and SMS marketing consent.9Shopify Help Center, Collecting customer contact information

A practical rule: use double opt-in for EU email lists, giveaway and ad landing pages, and any source where fake sign-ups are common. Single opt-in can fit checkout consent, where the buyer has just given a working email for the order. For SMS, the CTIA confirmation text already plays a similar role.

What to record as proof of consent

GDPR Article 7(1): "Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented."1EUR-Lex, Regulation (EU) 2016/679 (GDPR), Article 4(11), Article 7 and Recital 32 The burden of proof is yours. The EDPB says you should be able to show how and when consent was obtained, and the information given at the time. Online, it suggests keeping the session in which consent was given, the consent workflow at that time, and a copy of what the person saw. "It would not be sufficient to merely refer to a correct configuration of the respective website."2European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1 (May 4, 2020)

CTIA lists what to keep for text message opt-ins: timestamp, collection method, the language and action used, the specific campaign, IP address, phone number, and the identity of the person (name or another identifier such as a session ID).6CTIA, Messaging Principles and Best Practices (May 2023)

For each opt-in, keep:

• Who: email or phone number, plus a customer or session ID.
• When: date and time, with the time zone.
• Where: page, form name and form version (popup, footer, checkout).
• What they saw: the exact wording and links shown, including the privacy policy version.
• What they did: ticked the box, submitted, clicked the confirmation link.
• Which channel and purpose: email newsletter, SMS marketing, a back-in-stock alert.
• Technical context: IP address and country, which also tells you which law applied.
• Withdrawals: when and how they unsubscribed. Under Article 7(3), withdrawing must be as easy as giving consent.1EUR-Lex, Regulation (EU) 2016/679 (GDPR), Article 4(11), Article 7 and Recital 32

Keep the proof as long as you use the consent. After that, the EDPB says it should be kept no longer than strictly necessary for a legal obligation or for legal claims.2European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1 (May 4, 2020) When you change a form's wording, save the old version: a record pointing to "the current popup" proves nothing once the popup has changed.

Incentives: discounts, giveaways and consent

Most ecommerce opt-in forms offer something: a first-order discount, free shipping, early access, a giveaway entry. That's allowed. The EDPB says the GDPR "does not preclude all incentives," though the burden is on you to show the consent was still freely given.2European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1 (May 4, 2020) Its own example is a fashion retailer's newsletter with discounts: a subscriber who later withdraws consent to personalization goes back to receiving non-personalized discounts, and that isn't a penalty, "as only the permissible incentive was lost."2European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1 (May 4, 2020)

The Planet49 finding is from the Court's press release on the ruling: consent "must be specific so that the fact that a user selects the button to participate in a promotional lottery is not sufficient."3Court of Justice of the European Union, Press release No 125/19, Judgment in Case C-673/17 Planet49 (Oct 1, 2019) The case was about cookies, but the reasoning on specific consent is the same one the EDPB applies to marketing.2European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1 (May 4, 2020)

Describe the incentive accurately. If free shipping has a minimum order, or the code excludes some products, say so on the form, not only in the welcome email.

Opt-in form best practices

Once the consent is right, the form still has to be filled in. These are the points the leading guides agree on, without the made-up conversion rates.

1. Ask for one thing first. An email field and a button. Ask for the phone number on a second step, or on the confirmation page. Each extra field must change what you send.
2. Say what they'll get and how often. "New drops and restock alerts, about once a week" sets the expectation and filters out people who'll complain later.
3. Name the channel next to each box. "Email me" and "Text me" are separate choices with separate wording.
4. Make closing easy. A visible close button, a tap outside, and a frequency cap after a close.
5. Match the form to the page. A recipe page can offer a recipe guide; a product page can offer a restock alert. The welcome discount can wait for the homepage and collections.
6. Show what happens next. "Check your inbox to confirm" for double opt-in, or the code on screen for single opt-in.
7. Link the privacy policy at the point of collection, and the SMS terms next to the SMS box.
8. Send the welcome message right away. That first email or text is where the subscriber decides if they wanted this. What follows, from the welcome series to win-back emails, is covered in triggered email campaigns.

If you use exit-intent forms to recover carts, remember the email captured there is for the cart reminder or the offer you promised. The reminder flow itself is covered in how to reduce cart abandonment.

How to measure opt-in forms

Measure each form separately, and follow the subscribers past the sign-up.

There's no universal good sign-up rate: it depends on the traffic, the offer and how the form is triggered, and published figures mostly come from form vendors. Compare your forms against each other and against their own past, and use an A/B test for changes to the offer or the trigger. The method is in what is A/B testing.

The last row is the one most stores skip. A popup that adds subscribers but lowers the product-page conversion rate may cost more than it brings. Run the test on orders, not only on sign-ups.

For more on EU data protection terms, see the GDPR glossary entry.