In my subscription form I want to use a double opt-in method:

  • First, the visitor subscribes
  • Then a confirmation email is dispatched. If he replies...
  • Then I add him to the system.

In the case where the user does not reply, how long can I store their email address? Are there any legal requirements with regard to that?

I am from U.S. and I am also interested in the policy in European countries.

  • 3
    In the UK, the "Data Protection Act" is relevant. AFAIK, it doesn't restrict what you can store directly, but subscribers can request (for a fixed nominal fee) copies of all data you hold on them, and can at least demand that you correct errors. I assume there are similar acts in at least some other countries in Europe. These probably don't affect you unless you have offices in those countries.
    – user8709
    Mar 6 '12 at 18:07
  • 1
    As long as you are not spamming the email account and you keep it safe then how can anyone prove that you actually have their email address on file? (Disclaimer IANAL)
    – maple_shaft
    Mar 6 '12 at 18:12
  • 2
    @maple_shaft - That's a poor way to look at things. Slaps - "You didn't see me do it".
    – Craige
    Mar 6 '12 at 18:20
  • @foodil - I would say between 30 and 60 days would be an answer most people would feel is reasonable. Is there a law that says "after x days you must delete the email of a user" not at this time. You would have to do research on the laws within Europe more specfic answer risk making this way to localized.
    – Ramhound
    Mar 6 '12 at 18:34
  • 2

However for easier conversion, you can send the subscriber a reminder as follows:

a) 15 days - thanking them for subscribing to your services, and letting them know that there is only one more step to go to activate their account

b) 45 days - Letting them know that they are missing out on the goodies on your site or news letter

c) 75 days - letting them know a while ago they signed up and you would like them to complete activation

After 90 days delete their information, because they are not going to come back anyway. I remember Google and Microsoft would only hold data for 3 months before deleting it, but I am not yet sure anymore what the number is.


There's no official policy or so as far as I know. It entirely depends on how long the developer wants to store it in the database.

  • Yes . I have read the official compliance for this question. There is not stated so i think it can be stored as long as you don't mail them.
    – Leo Chan
    Mar 6 '12 at 18:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.