I too find this change of terminology confusing. I don't really mind "double opt-in," because it is fairly clear that there has been a genuine confirmation. The language purists among us can then argue whether or not a double opt-in implies two confirmations, but this is just an academic debate. The litmus test is that when I say something like "I think the law should be changed to mandate double opt-in" in front of the kind of crowd Paul referred to, I see an immediate expression of concern in their face, followed by a quick glance at my badge. Everybody seems to understand what it means. Nobody answers with sentences like "Well, personally, I think that what double opt-in really means in the end is that you have to include some kind of footer in your message saying that..."

"Confirmed opt-in" on the other hand is inherently unclear. What the people who coined this expression mean is that you have to opt-in, possibly via insecure channels, and you then get a confirmation of your subscription, with opt-out instructions. This may, if you were subscribed in error, you can correct it immediately. What *I* meant when I came up with this idea in 1993 is that you have to confirm your subscription, ie double opt-in.

Anyway, one thing I learned a long time ago is that when you are talking to lawyers, you had better reuse the terms they introduce to you, especially if you are not paying them and they don't have a duty to educate or correct you. You and I may think that "confirmed opt-in" means "Subscription= Open,Confirm" but, if we were to tell lawmakers to make sure the law mandates confirmed opt-in, we would end up with a law for unconfirmed opt-in.

My general comment on this legislation business is that we need to bear in mind that, for most countries/states, the current spam law is the first such law, and the lawmakers know as much about spam as we know about the details of the lawmaking process. In Sweden, the Dept. of Agriculture was tasked with writing the national spam law. Now we could spend the day discussing whether or not this was a smart move, but this is the move that was made, and something tells me that the Dept. of Agriculture did not specifically write petitions to have the honour of drafting this law because they were so genuinely interested and excited at the prospect. I think this landed on their desk and they just had to deal with it. Unfortunately, the law-making process still lags far behind where IT is concerned. Just about every politician will tell you that IT is not all that important, at least not when compared to the budget, the economy, unemployment, etc. The ones who say otherwise are just telling you what you want to hear. The truth is that 99% of politicians could not care less about IT, because nobody decides how to vote on the basis of IT policy. We could again debate whether or not this is the right thing for society, and I suspect most of us would quickly agree, but I felt it necessary to point out that the context of this spam legislation is one of politicians and lawmakers who are not spam experts, do not pretend to be spam experts, and feel that they have more pressing issues to address in their hopelessly overbooked agendas.

In this context, if we yell too much at them, they will understand that they have done something wrong and are clearly not going to win political points this way. They may decide that it was wrong to have a law at all. One message we must deliver clear and loud is that a law IS needed; the market will NOT self-regulate. We need to encourage lawmakers even if these first laws are not perfect. With perhaps a few exceptions here and there, they are far better than the mess we had before. Going forward, we must of course be very clear in pointing out the flaws in the new laws, but we should not allow the soft spam lobbies to gain any ground and try to go back the the self-regulation argument.

  Eric