Our verdict: fix the form wording and keep proof before the next send
This guide summarizes official EU guidance and is not legal advice. Most consent problems for small senders are fixable in an afternoon: a pre-ticked box, a sign-up form that doesn't say what you'll send, or no record of when and how someone joined. The European Data Protection Board's guide for small businesses says you must be able to demonstrate that the person whose data you process gave consent [1].
Who needs this: anyone collecting email sign-ups from people in the EU. The European Commission says the GDPR applies to organisations outside the EU when they offer goods or services, paid or free, to individuals in the EU [3]. Who can skip it: a business that does not target people in the EU at all, though other privacy and anti-spam laws may still apply.
What valid consent needs, and how to apply it to a sign-up form
| Requirement | What the EDPB guide says | What to do on your form |
|---|---|---|
| Freely given | People must be able to refuse and withdraw without external pressure [1] | Don't make newsletter sign-up a condition of a purchase or download unless the newsletter is the thing offered |
| Specific | Consent must be specific to the processing purpose; ask again if purposes change [1] | Separate checkboxes for the newsletter and for partner offers |
| Informed | Tell people the purposes, who you are, data categories, recipients and the right to withdraw [1] | One or two sentences next to the button plus a privacy notice link |
| Unambiguous | A clear affirmative action, without pre-ticked boxes, separate from general terms [1] | Unticked box or a dedicated subscribe button |
| Provable | You must be able to demonstrate consent [1] | Keep the record described below |
| Withdrawable | Withdrawal at any time, and it must be easy [1] | Unsubscribe link in every email |
What to keep as proof of consent
The EDPB guide says you must be able to show consent and suggests a written declaration or a deliberate action such as ticking a box [1]. It also recommends refreshing consent at appropriate intervals [1]. In practice, keep enough to answer the question: who agreed, to what, when and how?
- The email address and the date and time of sign-up.
- Which form or page they used, and a dated copy or screenshot of the form wording at that time.
- Whether they confirmed by double opt-in, and when.
- What they agreed to: newsletter, offers, or both.
- The date of any unsubscribe or objection, and confirmation it was applied.
- If children could sign up, note the EDPB guide: those 16 and over can consent themselves, younger children need a parent or guardian, and EU countries may set the age between 13 and 16 for online services [1].
Withdrawal, objections and data requests
- Withdrawal must be easy for individuals to do, and it does not affect processing carried out before it [1].
- For marketing, the EDPB guide says the data subject has a right to object without giving reasons, and an objection means you stop that processing [2].
- Respond to access, erasure and other requests within one month, extendable by two months for complex requests if you tell the person within the first month [2].
- People can ask whether you hold their data and get a copy, usually free of charge [2].
- Erasure can be requested when the data is no longer needed for the purpose it was collected for; limited exceptions exist, such as legal obligations [2].
- The EDPB gives this example: a former customer who no longer wants marketing emails and asks you to erase their contact details must be erased if you have no compelling reason to keep them [2].
Which MailerLite features help
| Need | MailerLite feature | Caveat |
|---|---|---|
| Confirmation step | Double opt-in is on by default for new forms; a separate setting covers API and integrations [4] | Editing the confirmation email needs a paid plan [4] |
| Erasure requests | Forget removes a subscriber and completely deletes their information in 30 days; forgotten subscribers cannot be restored [5] | Delete keeps data in case they re-subscribe; use Forget for erasure requests. After a mistaken Forget you must wait 30 days to re-add the address [5] |
| Store sign-ups | E-commerce triggers only work for customers who subscribe and accept marketing [6] | Show a marketing checkbox at checkout |
| Proof of source | Form analytics show which subscribers signed up through each form, including unconfirmed [7] | The help page we read did not confirm IP or timestamp fields; check a subscriber profile in your account |
Worked example: fixing a lead-magnet form
Hypothetical form: Get the free checklist, with one pre-ticked box reading I agree to receive emails and partner offers. Three problems against the EDPB guidance: the box is pre-ticked, two purposes share one box, and readers are not told they can withdraw [1].
Fixed version: an unticked box for the weekly newsletter, a second unticked box for partner offers, a line saying you can unsubscribe in any email and a link to the privacy notice. Turn on double opt-in, screenshot the form with today's date and store it with your records. If the checklist is only available to people who subscribe, say so plainly and consider whether that pressure is fair; the EDPB says consent must be freely given [1].
Questions before you decide
Does GDPR require double opt-in?
MailerLite's help center states that double opt-in is not required by GDPR, though it recommends it. Double opt-in does give you a confirmation step that helps show the address owner signed up.
Does GDPR apply to my US business?
The European Commission says the GDPR applies to organisations outside the EU when they offer goods or services, paid or free, to individuals in the EU, or monitor their behaviour. A business that does not target people in the EU is not covered just because a customer travels there. Get legal advice for your situation.
How fast must I answer a subscriber's data request?
The EDPB's small-business guide says to respond within one month, extendable by two further months for complex requests if you tell the person within the first month.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- EDPB Data protection guide for small business: Process personal data lawfully Accessed 29 Oct 2026
- EDPB Data protection guide for small business: Respect individuals' rights Accessed 29 Oct 2026
- European Commission: Data protection explained Accessed 29 Oct 2026
- MailerLite Help: How to use double opt-in when collecting subscribers Accessed 29 Oct 2026
- MailerLite Help: How to delete or forget a subscriber Accessed 29 Oct 2026
- MailerLite Help: E-commerce automation triggers Accessed 29 Oct 2026
- MailerLite Help: How to find subscribers after they sign up Accessed 29 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.