Image: Silver Wings / Shutterstock.com
Anyone who sends out newsletters or promotional emails should ask themselves this question: In the event of a dispute, can we really prove that the recipient wanted to receive them?
A recent ruling by the Düsseldorf Administrative Court provides a fairly clear answer to this question. An email address, an IP address, and a few stored timestamps are not necessarily sufficient. Companies must be able to document much more clearly how a person actually gave their consent.
The ruling is therefore of interest to online retailers, agencies, newsletter publishers, and, in fact, any company that regularly sends advertising via email.
“But he did sign up!” – Then prove it
At first glance, the situation seems quite ordinary: A company sends out promotional emails. The recipient later claims never to have given consent.
What now?
Normally, you might think: No problem. The company has its technical data on file, after all. Email address, IP address, date, and time—that’s all the proof you need.
But it's not quite that simple.
In its ruling of July 27, 2026, the Düsseldorf Administrative Court clarified that such technical information alone is not necessarily sufficient to prove valid consent to a marketing email. In the specific case, the company had indeed stored data regarding a so-called double opt-in procedure. However, it was no longer able to produce the actual confirmation email.
That became the key issue.
After all, while an IP address can show that something happened via a specific Internet connection or device, it does not automatically prove which person was actually sitting in front of the screen.
More importantly, it is not immediately apparent from an IP address what content someone has agreed to.
Double Opt-In: The Standard So Far—But Make Sure to Document It Properly!
The so-called double opt-in process has been a standard practice in newsletter distribution for years.
The process is simple: A person enters their email address. They then receive a message containing a confirmation link. The registration is not complete until they click on that link.
The process is intended to prevent people from simply registering other people's email addresses for promotional emails.
However, the recent ruling makes it clear: It is not enough for the technical process to work. In the event of a dispute, companies must also be able to demonstrate that this process actually took place for that specific email address.
This was precisely where the problem lay in the Düsseldorf case.
Although the company was able to provide stored email addresses, IP addresses, and timestamps, it was unable to produce the actual confirmation message itself.
In the court's view, this meant that an important element was missing.
The message for companies is therefore uncomfortable, but understandable: It is not enough to simply say, “That’s how our system always works.” What matters is whether the specific consent of a specific recipient can be verifiably documented later on.
Why an IP address suddenly proves surprisingly little
At first glance, an IP address sounds like a pretty unique fingerprint.
But it isn't.
Simply put, an IP address refers to an Internet connection or a device on a network. It does not automatically reveal which person was using that particular connection at the time.
For example, this could mean: A family uses the same Internet connection. Employees share a company network. Or someone uses someone else's device.
Even if the IP address was stored along with the date and time, the crucial question therefore remains: Who actually clicked—and on what, exactly?
The court also noted that even a combination of several technical data points does not automatically constitute proof of consent.
In other words: Having two IP addresses does not automatically turn weak evidence into strong evidence.
Companies need to review their newsletter systems now
For companies, this ruling means one thing above all else: It’s worth taking a critical look at their own processes.
It is not enough to simply save the recipient's email address. It is also important to be able to track when and under what conditions the registration took place.
This includes, in particular, the specific statement by which a person consented to receiving advertising. The confirmation message and the subsequent confirmation process may also be decisive in the event of a dispute.
The problem here is a classic digital paradox:
Companies should not store personal data unnecessarily. At the same time, they may need to be able to provide evidence of consent over an extended period of time.
Therefore, the right solution is not “We’ll just store everything.”
Instead, companies should specifically document what they actually need for future verification—and ensure that their data storage and data protection processes are properly aligned.
What happens if proof is missing?
The real risk is that, in the event of a dispute, a company may not be able to prove that the promotional emails were permitted.
In that case, it may be difficult to rely on alleged consent.
In the Düsseldorf case, the relevant data protection authority had already issued a complaint against the company. The court upheld that decision.
This is an important point: The responsibility does not lie with the recipient to refute the claim. Anyone who bases advertising on consent must be able to prove that consent themselves in case of doubt.
Incidentally, this basic idea is not entirely new. Other courts have also emphasized in the past that the advertiser must provide concrete documentation of the recipient’s consent. As early as 2021, the Neumarkt Local Court had ruled that a mere list of technical data is not sufficient if it does not show that the specific individual in question actually gave their consent.
The new ruling from Düsseldorf now takes this line of reasoning a step further in a very clear way.
What Companies Should Do Specifically Right Now
Anyone who sends newsletters or other promotional emails should not wait until a complaint is filed to review their processes.
In particular, it makes sense to ask yourself the following questions:
Can we verify when each person subscribed to the newsletter?
Is the specific wording of the consent given at that time still clear?
Can we show which confirmation email was sent?
Can we track the click on the confirmation link?
Will we be able to clearly link the individual pieces of information to the same email address later on?
Do we know what data our newsletter system actually stores?
Have we determined how long these records should be retained?
If the answer to several of these questions is “No,” the company should take a closer look.
After all, a technically flawless newsletter system is of little value if, when it really matters, no one can explain why a particular person ended up on the mailing list in the first place.
A checkmark is not a free pass
Anyone who wants to send people advertisements should also be able to prove that those people actually wanted to receive them. It cannot be up to the recipient to spend years defending themselves against the claim that they clicked “Yes” somewhere at some point.
At the same time, this shouldn't turn into some kind of digital documentation frenzy. If companies had to store a complete digital resume for every user who signs up for a newsletter, it wouldn't help anyone.
An IP address is not a witness. A timestamp is not a witness. And an automated system is certainly not a witness.
Anyone who works with consent should document it in such a way that an outsider can later understand what happened.
That might be a little more work. But honestly, if a company is generating millions in revenue through email marketing, it shouldn't fail because it didn't properly document a single, crucial click.
Avoid costly warnings for sending unauthorized promotional emails. Schedule a legal consultation now and protect yourself!
to the lawyerAt a fixed price of 169 EURO (gross)
