Brevo: check consent for a newsletter subscription

Analysis of official documentation, with no testing on a paid account.

One person enters their address in a form but never clicks the confirmation email. Another confirms their subscription, then withdraws consent a few weeks later. These two addresses must be handled differently in a contact database. Keep a record of each contact’s expressed choice and its history.

Prepare the form, confirmation message and selection trace from the CNIL rules and Brevo functions. Mentions and legal basis must be adapted to your activity, your audience and the communications sent.

Distinguish prospecting rule and evidence tool

The CNIL distinguishes prospecting between individuals and professionals. For an individual, commercial prospecting by e-mail normally requires prior consent. This must be the result of a dedicated positive action, e.g. an unchecked box. For a professional, prospecting may be based on legitimate interest when soliciting is related to his profession, with information and the possibility of simple opposition.

The CNIL also documents an exception for an existing customer when messages relate to similar products or services provided by the same company. This exception applies to customers who have already purchased, beyond simply creating an account. These differences require that the context be qualified before copying an entire database into a newsletter list.

The double opt-in adds an email confirmation after submitting the form. The Brevo documentation on double opt-in specify that this mechanism is not made mandatory by the RGPD. However, he can check the address and provide additional events to demonstrate the course followed. Therefore, do not present the option as an automatic certification of conformity.

Write the text before building the form

Start with a sentence that makes sense without knowing your internal policy. It must identify the types of messages to expect and provide access to useful information. Vague wording such as "I agree to receive communications" does not explain whether the person will receive a monthly newsletter, partner offers or messages through several channels.

The CNIL guidance on consent has four cumulative criteria: it must be free, specific, enlightened and unambiguous. Where more than one purpose exists, it must be possible to select them separately. An order or access to a service should not be conditioned on a processing that is not necessary for its execution.

In Brevo, the field RGPD and declaration RGPD fulfil different roles. The field allows to collect a choice; the declaration informs in particular of the use of Brevo. The text proposed by the tool must be adapted to your requirements. For several categories of emails, the multi-list function allows to display multiple choices, and each list must correspond to a defined purpose.

Consider this case: a workshop offers a newsletter with advice and partner offers. Combining both purposes under one checkbox would make it impossible to understand what was accepted. Two separate choices, using concrete wording, make the decision clear on later review. This proposal illustrates the method; it is not ready-to-copy legal wording.

Configure double confirmation in Brevo

The procedure for creating a form Brevo allows you to select double confirmation. After submission, Brevo sends an email containing a link. The contact is added to the list after the click; without clicking, it is not added or subscribed according to this path.

Read five items before publishing:

1. The destination list corresponds to the purpose displayed and does not, by automation, feed another unannounced campaign.
2. The consent box is not pre-coded and its refusal does not preclude action that does not require such prospecting.
3. The confirmation email reminds the recipient of the context and includes the expected link. Brevo recommends repeating the consent wording in it to document what was accepted.
4. The pages displayed after the submission and after the click do not suggest that the registration is already active at the wrong time.
5. The final message and the first campaigns propose a coherent way of withdrawing the agreement or opposing it.

Brevo adds attribute DOUBLE_OPT-IN when double confirmation is used. In particular, the value distinguishes between confirmed contacts and those resulting from simple confirmation, without confirmation or from another method of addition. This attribute helps to segment but does not in itself describe the text presented, the purpose or any subsequent changes.

Maintain an understandable record of evidence

Brevo documents two types of logs: form-related events and transactional logs for the confirmation email. To track the journey from end to end, the documentation recommends exporting both. You can then match submission, email sending and confirmation, without claiming that a single field captures all consent information.

The internal file may contain the version of the form, the consent text, the purpose, the date of posting and the withdrawal procedure. Do not unnecessarily copy all contact data. The proof must remain proportionate, protected and understandable by the person who will resume the campaign.

If you substantially alter the purpose, data or conditions of the processing, do not discreetly change the text while considering the old choices as equivalent. The CNIL indicates that a significant change may require a reassessment of the validity of the legal basis. Keep the old version with its use period and review the new course.

Test the course without registering real customers

Prepare two email addresses controlled by the company. The first submits the form and stops there. The second submits it, receives the email, clicks and reaches the final page. These acceptance checks do not assess the law applicable to your business; they verify that the technical behaviour matches the journey you describe.

1. Before clicking, check that the unconfirmed address is not included in the planned campaign list.
2. After clicking, check the list, the dual opt-in attribute and the available events.
3. Send only a test message to the controlled address, then check the sender, content and unsubscribe link.
4. Use this link and check that the status prevents the next email of the same type.
5. Export a sample of authorized newspapers, record where it will be kept and who can read it again.

Check together the displayed statement, the saved click and the effect of the removal. A valid address and clear text cover only part of the control.

Cases that need a different approach

This guide aims at an email form created in Brevo. A form built on another platform requires specific automation and its own controls. The SMS does not follow the same double confirmation path in the Brevo documentation. Purchased databases, online addresses, transmission to partners, minor audiences or international campaigns require a separate analysis.

To prepare a campaign, consult the Review of inactive contacts. For sender and delivability, configuration DKIM and DMARC Answers another check. The Brevo review places these functions in the overall choice of software.

The expected result is not "all contacts have the value yes". It is a consistent journey: the right person sees a specific request, performs an identifiable action, receives the announced confirmation and can change their mind without difficulty. The evidence then becomes the trace of this journey, not an argument added after sending.