A double opt-in happens when someone submits a form, then receives an email containing a link they must click to confirm their submission. Only after that confirmation click is the respondent officially added to your list, rather than being added the moment they hit submit.
Double opt-in gives you explicit confirmation of consent for whatever action the form submission triggers, and helps ensure you're only gathering data from genuine respondents rather than typos, bots, or someone entering another person's address by mistake. It's a commonly used tool for GDPR compliance, since it directly supports getting clear, active consent, though it's worth noting double opt-in itself is not a mandatory requirement of GDPR; it's simply one of the more effective ways to demonstrate genuine consent.
If a respondent doesn't confirm, or actively opts out, their submission is listed under Opted-Out Entries, and that same email address can't be resubmitted through that particular form again, effectively respecting their decision not to be added, in line with the "right to be forgotten" principle under GDPR.
Double opt-in is one of several GDPR-supporting features in Zoho Forms, alongside marking fields as Personal (so they're treated with extra care and flagged before being shared with third-party integrations), field-level encryption, a Terms and Conditions field, and providing an edit link in submission emails so respondents can exercise their right to rectification themselves.