Newsletter: how to collect an email address without mistakes

Deciding to start a newsletter is the easy part: the real question, covered in when it makes sense to collect subscribers, is what you'll have worth telling existing customers on a regular basis. Once that's decided, one step is often treated as a technical detail when it isn't: how the email address gets collected. A signup form set up wrong doesn't just mean a shorter list: it means consent that can't be proven if someone disputes it.

Consent is needed almost always, and the exception is narrower than it looks

The baseline rule, written into article 130 of Italy's Privacy Code (Legislative Decree 196/2003), is that sending commercial email requires the recipient's prior consent. There's an exception, known as the soft opt-in, set out in paragraph 4 of the same article: consent isn't required when a business uses an email address a person gave it in the context of an actual purchase, to offer products or services similar to that one, as long as the person was informed of the right to opt out, both at the time of collection and in every later communication, and didn't exercise it (source: Italy's data protection authority, the Garante, guidelines of July 4, 2013 on promotional activity and anti-spam measures, point 2.7, accessed October 27, 2026).

What matters for anyone opening a newsletter today is where this exception stops. Italy's Supreme Court, with ruling no. 7555 of March 15, 2023, upheld a Garante fine against a site that had sent promotional emails to people who had only registered for a free trial, establishing that the soft opt-in presupposes a paid contractual relationship, meaning a completed purchase, and doesn't extend to someone who simply registered or used a free service. In practice: for a brand-new signup form, with no prior purchase behind it, this exception almost never applies. It's a narrow case for customers who have already bought something, not the easy route into starting a newsletter.

What doesn't count as consent

The GDPR defines consent as a freely given, specific, informed and unambiguous indication of wishes, expressed through a clear affirmative act (article 4(11)). Recital 32 spells it out: silence, inactivity, or a pre-ticked box don't amount to valid consent. The Court of Justice of the European Union applied this in case C-673/17, the Planet49 ruling of October 1, 2019, finding a cookie consent box that was ticked by default to be invalid. The same standard, an active step rather than an omission, governs any consent required under the GDPR, including signing up for a newsletter.

There's a second, less obvious mistake: collecting newsletter consent bundled with other requests, inside a single checkbox that also covers promotional offers or profiling. Article 7(2) of the GDPR requires that, when consent is collected together with other matters, the part covering consent be distinguishable from the rest, in clear and plain language. A single checkbox mixing different purposes doesn't meet the specificity requirement: each distinct purpose needs its own, separate request.

How to prove it, if someone disputes it

The burden of proof sits with whoever sends the emails, not with whoever receives them: that's what the accountability principle in GDPR article 5(2) and article 7(1) establish, requiring the data controller to be able to show that consent was given. The Garante made this concrete with decision no. 330/2025 of June 4, 2025, fining an online car dealer 45,000 euros for sending promotional emails without being able to prove valid consent: the plain signup-form log files the company used as evidence were found insufficient, since they're easy for the data subject to dispute and offer no guarantee against tampering. The Garante pointed to double opt-in, meaning sending a confirmation email the person has to open and actively confirm after signing up, as the minimum safeguard for proving consent if it's ever challenged.

It isn't a rule written into law for every single commercial send: it's the measure the authority treated as adequate once consent came under scrutiny. For anyone setting up a signup form today, it's still the safest starting point, since it costs little to implement and works as proof exactly when it would matter most.

What it actually takes

Putting the previous points together, a correctly built signup form has: a checkbox dedicated only to the newsletter, not pre-ticked and not shared with other purposes; clear wording on what subscribers will receive and how often; a confirmation email to open and confirm before the address actually joins the list; and a record of the date, time, and version of the consent text shown at signup, useful exactly if someone later denies signing up. This consent covers sending the emails: it doesn't replace the site's general privacy policy, which still needs to be written starting from a precise list of what each form collects, newsletter signup included.

Set up this way, the form itself is almost always the quick part to fix. What takes more thought is deciding, case by case, where the checkbox goes, what the text next to it says, and how the proof of signup gets kept: get in touch and let's work out how to set it up for your site.