Why GDPR consent wording matters for your email list
If people in the European Union or the UK can sign up for your emails, European privacy rules apply to how you ask, even if your company is based somewhere else. Those rules come from two places. GDPR defines what valid consent is, and each country's electronic marketing law, such as the UK's PECR, says when you need that consent before you send marketing email. For most businesses collecting newsletter signups, the answer is simple: you need consent, and you need to be able to prove you got it.
Valid consent under GDPR has to be freely given, specific, informed, and unambiguous. In practice, that means a few concrete things for an email signup:
- The person takes an action to opt in, such as ticking an empty box or clicking a button labeled for the newsletter. A pre-ticked box doesn't count.
- The form says what they're signing up for and roughly how often you'll write.
- Signing up for marketing is separate from accepting your terms or getting something else they asked for.
- They can withdraw consent as easily as they gave it, and you tell them so at signup.
- You keep a record of who agreed, when, and what they were shown.
None of this is hard to write. What trips teams up is that the wording lives in several places that drift apart over time. The form promises a monthly newsletter, but the welcome automation sends three emails a week. The footer says "unsubscribe at any time," but someone who unsubscribed last spring gets re-added when they download a guide. Each piece looked fine on its own when somebody wrote it.
That's a good job for an AI agent. Kite is an AI marketer. It researches your business, builds a growth strategy, and ships the work that brings you new customers. It already knows what you send and how often, it can read your forms and your email platform, and it checks every send against the opt-outs on record. So it can write the wording and then make sure your setup does what the wording says. You can work with Kite in your browser or in Slack.
How Kite makes your email signups GDPR-compliant
Kite starts with what you actually do with email. It reads your website's signup forms and privacy policy, looks at the audiences or lists in your connected email platform, and uses what it knows about your business to see what you send, how often, and to whom. That tells Kite what your consent wording has to cover.
Then Kite writes the three pieces of wording: the consent text on each signup form, the double opt-in confirmation email, and the unsubscribe wording in your email footer and on the page people land on after they leave. On a website Kite hosts, it puts the wording into the forms itself. In Mailchimp or Brevo, it writes the parts it can change directly and hands you the rest to paste in.
Finally, Kite checks that your setup keeps the promises. It confirms new signups go through confirmation, that unsubscribed people stay unsubscribed, and that every send skips people who asked to stop. After each campaign, it reads the unsubscribes and complaints to see whether anything needs to change.
- What does a GDPR-compliant email signup form need to say?
- Do you need double opt-in for your email list?
- What should an unsubscribe message include under GDPR?
- Keep proof of consent and honor every opt-out
- See whether the wording is working
What does a GDPR-compliant email signup form need to say?
A GDPR-compliant signup form needs an unticked consent box, a plain description of what people will receive, a note that they can unsubscribe at any time, and a link to your privacy policy. Your privacy policy carries the longer explanation, such as who you are, how long you keep the data, and which services process it. The form only needs the essentials a person should see at the moment they decide.
Kite writes that wording from your real practices rather than a generic template. It knows whether you send a weekly digest or a quarterly update, whether you mix in promotions, and what your brand sounds like. For a coffee roaster that sends a monthly newsletter, the consent line beside an empty checkbox might read:
Yes, send me the Harbor Roasters monthly newsletter with new coffees, brewing tips, and occasional offers. I can unsubscribe at any time using the link in every email. See how we use your data in our privacy policy.
Kite also looks at which forms should carry this wording at all. A newsletter box, a waitlist form, and a webinar registration are requests to hear from you. A contact form or a demo request usually isn't. When a form serves two purposes, such as a guide download that also offers your newsletter, Kite keeps the newsletter consent as its own optional checkbox so nobody has to join your list to get the guide.
On a website Kite builds and hosts, Kite edits the form directly. It adds the checkbox and the consent line, links your privacy policy, and leaves the change waiting as an unpublished change until you preview and publish it. If your site runs somewhere else, Kite gives you the finished wording to paste into your form builder. For more finished examples, see GDPR consent form examples for email signups Coming soon .
Do you need double opt-in for your email list?
GDPR doesn't require double opt-in by name, but it's the strongest way to prove that the person who owns an email address really agreed to hear from you. With single opt-in, anyone can type someone else's address into your form. With double opt-in, the new subscriber gets a confirmation email and joins your list only after clicking the link in it. In Germany and Austria, double opt-in is the expected way to show email consent, so for any list with European subscribers, Kite recommends turning it on.
The confirmation email has one job, which is to get the click. Kite writes it to be short, plain, and clearly about confirming:
Subject: Confirm your Harbor Roasters newsletter signup
Thanks for signing up. Please confirm you'd like our monthly newsletter by clicking the button below. If you didn't sign up, just ignore this email and you won't hear from us.
Button: Yes, subscribe me
Kite keeps promotions out of the confirmation email. If you've promised a welcome discount, Kite puts it in the first email after the person confirms. A sales pitch in the confirmation email turns it into a marketing email sent to someone who hasn't confirmed yet.
Where Kite sets this up depends on your tools:
- Mailchimp. Kite reads whether your audience uses double opt-in and can change that audience setting for you. Mailchimp keeps its confirmation email in its form builder, so Kite gives you the wording to paste in there.
- Brevo. Brevo sends its double opt-in confirmation from an email template, and Kite writes and updates Brevo templates directly in your account.
- A website Kite hosts. When a form on your site sends signups to Mailchimp, Kite adds each new person the way your audience is set up. If the audience uses double opt-in, the new signup is added as pending, and Mailchimp sends its confirmation email before the person becomes a subscriber.
Once confirmation is running, Kite can check how many new signups stay pending without ever confirming. If that number climbs, it's usually the confirmation email's subject line or the fact that it lands in a promotions tab. Kite can propose a clearer version and check the number again after the change.
To connect your website's forms to Mailchimp, see Send website signups to your email list.
What should an unsubscribe message include under GDPR?
Every marketing email needs a clear unsubscribe link that works in one step, without a login, a password, or a reason. GDPR says withdrawing consent must be as easy as giving it, and it gives people an absolute right to stop direct marketing. The footer should also remind people why they're getting the email, because a reader who remembers signing up is less likely to mark you as spam.
Kite writes the footer wording for your campaigns:
You're getting this email because you signed up for the Harbor Roasters newsletter at harborroasters.com. Unsubscribe with one click, or choose how often you hear from us.
In Mailchimp, that reminder is a setting called the permission reminder, which appears in the footer of every campaign sent to the audience. Kite can update it in your audience settings, and it writes your Mailchimp campaigns with the unsubscribe link in place.
The page people reach after unsubscribing matters too. It should confirm that the request worked and say plainly that they won't get more marketing email. It can offer a way back, but it shouldn't make the person confirm their decision twice. Kite writes that page's wording as well:
You've been unsubscribed. You won't get any more marketing emails from Harbor Roasters. Changed your mind? You can sign up again on our website.
Acting quickly on an unsubscribe is part of the promise. GDPR doesn't set a deadline, but regulators expect you to act promptly. Gmail and Yahoo ask anyone sending more than 5,000 emails a day to handle unsubscribes within two days, and most email platforms process them immediately.
Keep proof of consent and honor every opt-out
Compliant wording only helps if your records back it up. For every subscriber, you should be able to show when they signed up, which form they used, what that form said at the time, and whether they confirmed. Your email platform keeps much of this already. Mailchimp records each subscriber's status and when they signed up and confirmed, and on a website Kite hosts, every signup Kite sends to Mailchimp can carry tags that say which form it came from. Kite keeps the approved consent wording in your team's knowledge base with the date it went live, so you can show exactly what a subscriber saw.
Opt-outs need the same care. Kite protects them in three ways:
- On your forms. When someone who unsubscribed fills in a form on a site Kite hosts, Kite leaves them unsubscribed in Mailchimp. They only start getting email again if they opt back in themselves.
- Before every send. Kite checks every opt-out record available to it, including unsubscribes in the sending platform, your CRM's records, replies asking to stop, and anyone your team told Kite not to contact. Anyone marked there is left out, and Kite tells you who it skipped and why.
- When someone asks. When a person replies to say they want off your list, Kite unsubscribes them in Mailchimp. When someone asks you to erase their data, Kite permanently deletes that contact in Mailchimp or Brevo.
If you already have a list and aren't sure everyone on it opted in, Kite can sort your contacts by the consent record behind each one. See Clean your email list.
See whether the wording is working
After a campaign goes out, Kite reads its unsubscribes and spam complaints in Mailchimp or Brevo and compares them with earlier sends. A spike in complaints often means people don't remember signing up, which points to a footer reminder that's too vague or a signup form that undersold how often you write. On a site Kite hosts, Kite's analytics also count form submissions, so you can see whether adding the consent checkbox changed how many people sign up.
When the numbers point to a problem, Kite proposes the fix, such as a clearer consent line, a more honest description of how often you send, or a better confirmation subject line. Then it checks the same numbers after the next send.
What you get
Consent wording for each signup form
The checkbox line, a plain description of what people will receive, and a privacy policy link, written for your real sending schedule.
A double opt-in confirmation email
A short subject line and body that get the click, set up in Brevo directly or ready to paste into Mailchimp.
Unsubscribe wording
The footer reminder, the one-click unsubscribe line, and the page people see after they leave.
Forms that keep the promise
On a site Kite hosts, the updated forms, connected so new signups go through confirmation and past unsubscribes stay unsubscribed.
A record of what people agreed to
The approved wording and the date it went live, kept in your team's knowledge base next to the consent records in your email platform.
An opt-out check on every send
The people Kite left out of each send and the record that says why.
How to get started
Tell Kite what you want in plain language. You might say, "Make our newsletter signup GDPR-compliant," or "Write a double opt-in email and unsubscribe footer for our European subscribers."
If your list lives in Mailchimp or Brevo, Kite asks you to connect it. Mailchimp connects when you sign in to your account, and Brevo connects with an API key from your account settings. Kite then reads your forms, your lists, and your current settings, and brings you the wording along with any changes it recommends, such as turning on double opt-in.
You review the wording before anything changes. On a site Kite hosts, the updated forms wait as unpublished changes until you preview and publish them. In Mailchimp or Brevo, Kite shows you each change first and makes it once you approve.
Kite can write wording that follows European privacy rules for ordinary newsletter and marketing signups. If you collect sensitive data, such as health information, or market to children, it's worth asking a privacy adviser to review the final wording too.
Integrations used to make your email signups GDPR-compliant
Kite builds and hosts websites with their own forms, so the account you connect for this job is the email platform where your subscribers live. That's where the confirmation email, the unsubscribe status, and the consent records are kept.
Keep your subscribers and their consent
Kite reads whether each audience uses double opt-in and can change that setting, updates the permission reminder that appears in your footer, and sends signups from a site it hosts into your audience as pending or subscribed according to that setting. It unsubscribes people who ask, deletes contacts on an erasure request, and reads unsubscribes and complaints after every campaign.
Kite writes and updates the email templates Brevo uses, including the double opt-in confirmation email, reads your contacts and lists, deletes a contact when someone asks you to erase their data, and reads the bounces and unsubscribes from each campaign.
Common questions
Does GDPR apply to my company if we're based outside Europe?
Yes, if you offer products or services to people in the EU or the UK, even when your company is based in the United States or elsewhere. Collecting newsletter signups from European visitors on a site that sells to them puts those signups under GDPR. Many teams with international lists simply use the stricter European standard for everyone, which keeps one set of forms and one confirmation flow.
What's the difference between opt-in and opt-out consent?
Opt-in means people join your list only after they actively agree, such as ticking an empty box. Opt-out means you add people by default and let them leave. European rules require opt-in for most marketing email. The main exception, which the UK calls the soft opt-in, lets you email existing customers about products similar to what they bought, as long as you offered a clear way to opt out when you collected their address and in every email since. In the United States, CAN-SPAM works on an opt-out basis, but you still have to honor every unsubscribe.
Can I offer a discount or a free guide in exchange for signing up?
Yes, as long as the person can see what they're signing up for. The safest approach is to offer the guide or discount on its own and ask for newsletter consent with a separate checkbox, because consent that's a condition of getting something unrelated isn't considered freely given. If the offer is the newsletter itself, such as 10 percent off your first order for subscribers, say so clearly on the form and deliver the discount after the person confirms.
How long should I keep proof of consent?
Keep it for as long as you're emailing someone on the basis of their consent, and for a reasonable period after they unsubscribe so you can answer a complaint. The record should show when they signed up, which form they used, what it said, and when they confirmed. Your email platform holds most of this, and Kite keeps the dated versions of your consent wording in your team's knowledge base.
Do I need to ask my existing subscribers to opt in again?
Not if you already have a clear record of their consent. You only need to act on the contacts without one. Be careful how you do it, because in the UK and EU an email asking for permission to send marketing counts as marketing itself. Kite can sort your existing list by the consent record behind each contact so you know which group you're dealing with before you decide.