Create newsletter signup form — build your email list

Sending newsletters in Germany without double opt-in invites costly cease-and-desist letters — case law has been clear since 2011 (BGH I ZR 164/09). Every signup requires confirmation via a link click in a separate email. The form submission alone is not enough.

In practice: after submit you store the address in a "pending" status and send a confirmation mail containing a signed token link. Only the click activates the entry. The token should be time-limited (24-72 hours) and invalidated after use — otherwise an intercepted link could be misused.

Also log timestamp, IP address and user agent at the moment of opt-in. This is not just GDPR duty (proof of consent under Art. 7(1)) but your defence against legal challenges. Without this data the consent counts as unproven — and therefore unlawful.

A newsletter list without source tracking is a black box. You see 5,000 subscribers but do not know whether 4,000 came from a single LinkedIn post or are evenly distributed. This information is crucial when you plan marketing budgets or a source dries up.

Technically this works with hidden fields that send a static source string per embed location: "blog-footer", "exit-popup", "lead-magnet-pdf-x". On top of that UTM parameters from campaigns land automatically in the record. Together they give you the full story — where the subscriber first appeared and through which campaign they came.

Sources should follow a clear naming scheme from the start. "Blog-Footer-2026" is clearer than "Footer-V3" — and in two years you will still know what was meant. An activity-log column that records every new source helps later when cleaning up orphaned sources.

A single newsletter template for all subscribers is the main cause of unsubscribe rates above 0.5 percent. Not every marketing manager cares about your engineering news, not every engineer about pricing updates. Anyone who introduces segments only after 12 months ends up with thousands of records without segment assignment — and has to guess or re-ask.

The solution is simple: ask one or two interest fields as optional tags during signup. "Which topics interest you most?" with three to five choices. Not required — anyone leaving it empty lands in the "All" default segment. But 60 to 80 percent of signups click one or two tags and provide segment data for free.

The tag structure matters. Three to five top-level themes are better than twenty detail tags. "Marketing", "Engineering", "Sales" works — "Newsletter tips for SaaS CMOs in DACH" is too specific and rarely used. Tags can later be assigned automatically via the calculation engine (for instance based on click behavior in previous mails).

From a GDPR perspective newsletters are pure advertising — so Art. 6(1)(a) (consent) applies, not legitimate interest. Consent must be informed, voluntary and for a clear purpose. "By signing up you accept our terms" is not enough — you need a separate, unbundled checkbox directly on the form.

The checkbox text should be precise: who sends, what is sent, how often, how to unsubscribe. "Yes, I want to receive the Questee newsletter (max. 2 emails per month). Unsubscribe at any time via the link in every mail" covers all mandatory information. The box must not be pre-checked (BGH ruling "Cookie consent II", I ZR 7/16).

Retention: as long as consent is valid — that is, until unsubscription. After unsubscribe you should delete name and email but keep the opt-in proof (date, IP, source) for three more years. These records are your insurance against claims that someone never consented — and three years is the statute of limitations under German civil code.

A single welcome mail is wasted attention. In the first moment after double opt-in confirmation, willingness to click is at its peak — typical open rates are 60 to 80 percent compared to 20 to 30 percent for standard mails. A three- to five-part sequence puts that attention to better use.

A proven pattern: day 1 — confirmation plus a concrete help (a checklist or a template). Day 3 — a story about the product or the founder, no sales pitch. Day 7 — a question to the subscriber ("What was your biggest aha moment last month?"). Replies go to a real inbox — not noreply. The first real conversations grow from there.

Important: the sequence must not be a sales barrage. Anyone receiving three buy-now links in the first week unsubscribes. Building relationships is a marathon — the welcome sequence is the first 5 kilometers. A webhook to the email tool (e.g. after double opt-in confirmation) starts the sequence automatically, the source tag controls the variant.