HubSpot double opt-in: why your EU leads never confirm

A German lead downloads your guide. HubSpot sends them an email asking them to confirm, in English. They never click it, so they never get the guide either, because the guide was waiting in a workflow email that HubSpot will not send until they confirm. On the dashboard it looks like nobody in Germany wants your content.

Every part of that setup is working as designed. Double opt-in was switched on after the delivery flow was built, and nobody went back to see where the two meet.

Two consents, two switches

EU email rules ask two questions, and HubSpot keeps the answers in different places.

The first is whether you may send someone marketing email at all. In HubSpot that is the contact's subscription status, and double opt-in is one way of collecting it with proof attached.

The second is whether you may record that they opened it, which is the job of the tracking pixel in every marketing email. HubSpot's own guidance is plain about the split: tracking consent and consent to receive communications are separate, and the Legal basis property does not record consent to track opens and clicks.

Most of the trouble starts when a team settles one question and files the other under done. Switching either setting on or off leaves the other exactly where it was.

What double opt-in does in HubSpot

With double opt-in on, a new contact created through a HubSpot form, a non-HubSpot form, a lead ad form or the Forms API gets an email with a confirmation link. Until they click it, they cannot receive marketing email from you. The hold also covers existing contacts who have never been sent a marketing email, and new contacts created from the Sales extension, who can still get one-to-one sales email in the meantime.

What you can configure depends on the tier. Starter and the free tools give you one default confirmation email for every form, with the sender, language and subject line editable. Professional and Enterprise let you apply it to chosen forms and pages, write your own confirmation email, pick the page people land on after confirming and add a follow-up.

Two details surprise people. Imported contacts do not get the confirmation email at all, so their status has to be confirmed some other way. And confirmation belongs to the email address, so a contact who changes their primary address goes back to unconfirmed.

It covers marketing email only, not SMS or WhatsApp.

Why lead-magnet leads never confirm

A low confirmation rate usually gets pinned on the confirmation email. The flow around it deserves a look first.

Start with how the asset is delivered. If the guide goes out in a workflow marketing email, HubSpot will not send it to an unconfirmed contact. It retries for up to 24 hours, then moves the contact on to the next action without sending anything. So the lead filled in a form, got an email asking them to confirm something, and never received what they asked for. Put the download on the thank-you page or the confirmation page instead, and confirming becomes a choice about future email rather than a toll on the guide.

Then check the language. HubSpot sends double opt-in email in the language of the form the contact came through, but only if that language has an active double opt-in version; otherwise it falls back to the default. A German form with no German confirmation email sends English, and an English email arriving seconds after a German form looks a lot like spam.

The default confirmation email does its job and nothing more. On Professional and Enterprise it can be rewritten to name the guide and say plainly what the person is agreeing to. Starter limits you to the sender, language and subject line, so the subject line has to do that work.

If all of that is in order and the rate is still low, look at deliverability. It is a separate investigation, and worth doing before anyone decides German buyers are not interested.

Why German teams treat it as standard

German teams switch double opt-in on by default because of what happens when a recipient disputes consent. German competition law, Section 7 of the UWG, treats marketing email sent without prior express consent as an unreasonable nuisance, with a narrow exception for existing customers being offered similar products. If a recipient says they never agreed, the sender has to show that they did.

The Federal Court of Justice set that bar in 2011, ruling that an advertiser has to document each individual consent in full. The same judgment accepted a confirmed double opt-in as enough to keep mistyped or misused addresses from receiving email advertising, and refused to stretch it to phone calls: a confirmed email address does not prove anyone agreed to be called.

A portal collecting German leads without double opt-in has nothing to produce if one of those leads complains. For the wording on the forms themselves, a German privacy lawyer is the right reviewer. We work on the HubSpot side of it.

Tracking consent: what France and Italy changed

France and Italy have both said that the pixel used to record email opens needs consent in most marketing uses.

France's data protection authority, the CNIL, adopted its recommendation on tracking pixels in March 2026 and published it in April. It treats the pixel the way it treats cookies. Measuring open rates to tune campaigns needs consent, and so does using opens to build profiles or spot fraud. The exemptions are narrow: security around authentication, and open measurement for deliverability that is limited to slowing or stopping email to inactive addresses, with only the date of the last open kept. Even those apply only to emails the recipient asked for. Addresses collected before publication had until July to be told about the pixels and given an easy way to object.

The CNIL also assesses consent to the pixel separately from consent to send. In B2B that matters, because prospecting email to professionals that needs no consent to send can still need consent to track.

Italy's data protection authority, the Garante, adopted its guidelines on tracking pixels on 17 April 2026 and published them in the Official Gazette on 29 April, with six months to comply, which runs to the end of October 2026. The Italian version is more relaxed about collection: tracking consent can sit inside the broader consent to promotional email, provided the request is neutral and not forced, and pixels used only for aggregate statistics are exempt. Refusing tracking must not limit anyone's use of the service.

Both sets of rules apply to the person receiving the email, wherever the sender is based. HubSpot's guidance says the same, and also that HubSpot does not turn off email tracking based on a contact's location, so the decision stays with whoever runs the portal.

How you handle it depends mostly on how much of your list is in France or Italy.

• The blunt option is the account-wide switch. Marketing email tracking sits under Settings, Marketing, Email, Tracking, and turning off opens takes click tracking with it by default. One-to-one email has a separate switch in the Activities object settings, covering CRM, sequence and Sales extension email. There is nothing to maintain afterwards, and no open data from anyone.
• Per email, any marketing email can have open and click tracking removed in its setup before it sends. French and Italian recipients go in their own segment and get the untracked version, which doubles the sends for every campaign that reaches them.
• If your portal has HubSpot's Consent Email Tracking Capabilities beta, that is built for managing consent to open and click tracking. Read HubSpot's documentation for it before planning around it.

Whichever route you take, find out what depends on opens before that data stops arriving. HubSpot warns that analytics, send time optimisation, workflows, segments and lead scoring can all be incomplete with tracking off. Open data was already shaky, as we covered in cookieless attribution, so this may be the push to stop leaning on it.

What to check in your portal

1. Every form that collects EU leads: is double opt-in on for it?
2. Lead magnets delivered by workflow marketing email. Move them to the thank-you or confirmation page.
3. Form languages without their own active double opt-in version.
4. The confirmation email itself, and whether it names what the person asked for.
5. Imported contacts, and how their subscription status gets confirmed.
6. The number of contacts you email in France and Italy, since that decides the tracking route.
7. Segments, scores and workflow branches that key off opens.

Subscription status and consent fields are among the first entry points we look at when cleaning up a messy HubSpot portal, and somebody has to own them afterwards, which is most of what data governance for a small team comes down to. The opt-out side, including why a reply should not carry an unsubscribe footer, is in marketing email vs sales email, and all of it sits inside marketing operations.

The German lead at the top of this page did nothing wrong, and neither did whoever switched double opt-in on. The two settings had never been introduced to each other.

Common questions