No Valid GDPR Consent: Double Opt-In Without Documentation (Administrative Court of Düsseldorf)

On 27 July 2026 (case no. 29 K 9714/24), the Administrative Court (Verwaltungsgericht, VG) of Düsseldorf, deciding on a reprimand, clarified what really matters when it comes to proving consent.

Key finding: A double opt-in procedure as such is not enough. Under Art. 7(1) GDPR, the controller must be able to demonstrate the specific consent of the data subject. The following are not sufficient for this proof:

• the e-mail address

• the sign-up IP address with timestamp

• the DOI IP address with timestamp

The court's reasoning: An IP address addresses a device, not a person. It proves neither who acted nor what the content of the confirmed declaration was.

If proof fails, the consent is deemed not to have been validly given. Consequence: the same as if consent were entirely absent.

Particularly unfortunate in the case decided: the company had told the supervisory authority that it archived all DOI e-mails via bcc and could print them out. It thus asserted a procedure that would in principle have been adequate. However, the company had not adhered to this procedure. Despite this sweeping statement, it was unable to produce the specific confirmation e-mail of the data subject who had lodged the complaint. The court concluded from this that the company was unable to furnish proof.

Practical note for e-mail marketing: The procedure that has been set up must actually be lived, and every single confirmation must be stored in an audit-proof and reproducible manner. Anyone who instead merely retains log data bears the full risk of proof – the controller itself, and precisely not the data subject (within the meaning of Art. 4 no. 1 GDPR).