Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite
1

I have a monthly newsletter. In my subscribe form I use a double opt-in method:

  1. The visitor subscribes.
  2. I send him a confirmation email.
  3. If I receive a reply, I add him/her to my system.

In the event I do not receive a reply, how long can I store his/her email address? Are there any legal requirements related to that?

I am from the US and I am also interested in the policies of European countries.

share|improve this question
1  
Your english was poor for someone who is from the US. I suggested an edit with improvements. In the future, please note that better formatted and written questions will be better accepted and probably receive better answers. – George Bailey Mar 6 '12 at 17:58
A couple questions: When you send the confirmation letter, is that an email or an actual letter? second: This "subscription" you refer to, is this just an email that you send out once every month or so, or is it something else (is it free)? It may seem obvious, but I hope to clear up any ambiguities in the question. – George Bailey Mar 6 '12 at 18:01
email for confirming and it is just a monthly newsletter – foodil Mar 7 '12 at 6:00
3  
Is the e-mail address the only thing you're storing about the user? If not, please list all data that you will be storing per-user, as different privacy laws apply to different types of data. – Iszi Mar 7 '12 at 6:22

1 Answer

up vote 4 down vote

For the US, there are no legal requirements that I know of. I do not know European law and cannot advise you on that.

I would suggest giving the person, say, 14 days to respond. If the person does not respond within 14 days, delete their email address. If you haven't heard from them within 14 days, you're probably not going to hear from them. And for odd corner cases, people can always go back and re-subscribe to start the process all over again, if necessary.

share|improve this answer
+1 as focusing on the practical here is probably the way to do it. Because there are so many different rules for different types of data in different jurisdictions, @DW's solution is likely to be both safe and relevant. – Rory Alsop♦ Mar 7 '12 at 8:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.