Build a GDPR-Friendly Mailing List in WordPress

· 7 min read

If you collect email addresses on your site, a GDPR mailing list in WordPress comes down to three practical things: knowing who agreed to hear from you, making it easy for them to stop, and making sure your campaigns only reach the people who said yes. This tutorial shows how to set that up with Optcatch, a free WordPress plugin that captures leads from the forms you already have, keeps a consent record for each contact, and sends email campaigns from your own accounts.

A quick note before we start: no plugin can make you compliant on its own. Optcatch gives you records and controls that help. Whether your mailing list meets the GDPR (or any other law) depends on your legal basis, your privacy policy and how you actually use the data. If you are unsure, talk to a qualified adviser.

What the GDPR expects from a mailing list

You do not need to be a lawyer to understand the core ideas behind consent-based email marketing. Under the GDPR, consent should be:

  • Freely given – people can say no without losing access to what they came for.
  • Specific – they agree to marketing email, not to a bundle of unrelated things.
  • Informed – they know who is asking and what they will receive.
  • Unambiguous – a clear, active signal, such as ticking an unticked box.

Two more principles matter in day-to-day use. You should be able to show a record of when and how someone agreed, and people should be able to withdraw consent as easily as they gave it.

The rest of this guide maps those ideas to settings and behaviour in the plugin.

Install Optcatch from the WordPress plugin directory (see the getting started guide or the plugin page) and activate it. A new Optcatch item appears in your admin menu.

Go to Optcatch → Settings and find the consent policy. There are two options:

  • Strict Consent (Explicit Checkbox Required) – the default and the recommended choice. A contact is only recorded if the visitor actively ticks a marketing opt-in checkbox.
  • Automatic Consent on Submission – every form submission is stored as a contact without a checkbox. The plugin records that the contact was captured under this policy, not as a ticked box. You are responsible for having a legal basis to email these people.

For a consent-based mailing list, keep Strict Consent. It matches the "clear, active signal" idea above.

While you are here, review the consent wording shown next to the checkbox. The text is editable, and the plugin keeps a version of it: when you change the wording, a new version is recorded, so each contact's record points to the exact text they agreed to.

Step 2: Capture signups from the forms you already have

You do not need a new signup form. Universal auto-detect is on by default and works with any form on your site that has an email field: Contact Form 7, WPForms, Elementor Pro Forms, Gravity Forms, Fluent Forms, Ninja Forms, theme and page-builder forms, popups and custom HTML. WooCommerce customers can opt in at checkout or account registration.

Under Strict Consent, the plugin adds its consent checkbox to the forms it detects. What happens next depends on the visitor:

  • They tick the box: the contact is stored with their details and a consent record.
  • They leave it unticked: nothing is sent to the plugin or stored. The form still submits normally, so your contact form keeps working as before.

That second point is important. Visitors who only want to send you a message are not quietly added to your list.

Already have a marketing opt-in checkbox?

If your form already has its own marketing checkbox, add the CSS class lcc-consent to that checkbox or its field wrapper, and the plugin uses it as the consent gate instead of adding a second one. Native consent fields such as the Contact Form 7 [acceptance] field are recognised as the opt-in when the label mentions newsletter, marketing, opt-in, subscribe or updates. See using your own checkbox for the details.

Many forms have an "I accept the privacy policy" or "I agree to the terms" checkbox. Under Strict Consent, a terms or privacy checkbox is not treated as marketing consent. Agreeing to your terms is not the same as asking for your newsletter, and keeping them separate supports the "specific" part of consent.

Every contact gets a consent record. For a visitor who ticked the box, the plugin stores:

  • the email address and any of phone, first name, last name and company from your form
  • the URL of the page the form was on
  • a consent status of "opted in"
  • the exact consent wording shown, its version, and a UTC timestamp

You can see the consent status, consent timestamp and source for every contact under Optcatch → Contacts, and filter by consent status.

This is the kind of record that helps you answer the question "when and how did this person agree?" if a subscriber or regulator asks.

The plugin does not capture passwords, payment card data or other sensitive fields from your forms. By default, mail is delivered through your site's own wp_mail() and no contact data leaves your site. If you connect SendGrid, Gmail, Microsoft 365 or an SMTP server as a sending account, the recipient address and email content go to that provider so it can deliver the message.

Step 4: Import an existing list with a permission record

If you already have subscribers in a spreadsheet, you can import them as a CSV file (up to 5,000 rows per file) with the Import button on Optcatch → Contacts.

Before the import runs, you confirm the statement "I confirm I have permission to email these contacts." The plugin then records each imported contact with:

  • a consent status of "customer declared"
  • the permission statement you confirmed and a UTC timestamp
  • the fact that you ticked the confirmation box, when you did it and your user ID

This does not create consent where none existed. It records that you, the site owner, declared you have permission, and who made that declaration. Only import people you actually have a basis to email. The plugin does not scrape or buy email lists.

Step 5: Send only to people who opted in (allowlist sending)

When you build a campaign, you choose a segment (by source (captured or imported), tag, signup date or consent status; Contact Form 7, WPForms, Elementor Pro Forms and Gravity Forms tag their contacts automatically), and the plugin shows the number of consent-verified recipients.

Behind that count, every send works from a positive-consent allowlist. Only contacts with a sendable consent status (opted in from a form, or customer declared on import) are included, and unsubscribed contacts are always excluded. A segment filter cannot remove that check. In practice, this means a badly built segment cannot pull in contacts without a consent record or people who have unsubscribed.

Step 6: Make unsubscribing one click

Withdrawing consent should be as easy as giving it. Optcatch handles this in two ways:

  • A one-click unsubscribe link in every email. Add the {{unsubscribe_url}} tag to your template footer. Each recipient gets a personal link.
  • List-Unsubscribe headers. These let mail apps such as Gmail show their own unsubscribe button, including the one-click version.

When someone unsubscribes, their status changes to "unsubscribed" with a UTC timestamp, and they are excluded from future sends.

That status also survives re-imports. If you later import a CSV that happens to contain someone who unsubscribed, they stay unsubscribed. This closes a common gap where an old export quietly re-adds people who asked to leave.

Step 7: Update your privacy policy

The plugin's readme includes a sample privacy-policy clause you can adapt. It covers what is stored when someone ticks the consent box (contact details, the page they submitted from, the consent wording and the date and time), what it is used for, and how to withdraw consent with the unsubscribe link. It ends with a placeholder for your contact address for access or deletion requests.

Treat it as a starting point. Your privacy policy is your responsibility, and it should describe everything your site does, not just this plugin.

A short checklist

  • Keep Strict Consent selected unless you have another legal basis and know why.
  • Review and edit the consent wording so it says clearly what people will receive.
  • Mark any existing marketing checkbox with the lcc-consent class.
  • Import only lists you have permission to email.
  • Put {{unsubscribe_url}} in every template footer.
  • Update your privacy policy.
  • Get qualified advice if your situation is unusual or you are unsure.

Get started

You can download Optcatch for free from WordPress.org. The free version has no usage limits: unlimited contacts, saved segments and custom templates, CSV import and any number of sending accounts. Consent records, allowlist sending and one-click unsubscribe are part of the free plugin.

Try it on your own forms

Optcatch is free on WordPress.org, with no usage limits. Install it, connect a sending account and your existing forms start building a consented list.

Download free Read the getting-started guide