Email Verification

Email verification is the first step of identity verification. It confirms that the person who submitted a privacy request owns the email address on it, so you only respond to the real data subject. Every request submitted through your Privacy Center goes through this step when the Send verification rule is on for the requested right.

Turning email verification on

Email verification is controlled per privacy right by the Send verification rule. The same rule selects which verification email template is sent. Because it's set per right, you can choose which request types require verification.

To learn how to edit the email itself, including its body, branding, and per-brand templates, see Verification Email Template.

What the data subject experiences

1. They submit the form. The Privacy Center shows an Almost done! page explaining that a verification link was sent to their email address, and that they have 7 days to complete verification.
2. They receive the verification email. It contains a Confirm my email address button. The link in the email expires after 7 days.
3. They click the button. This confirms they own the email address.

If you enable Send a reminder one week later on the template, data subjects who haven't verified within the first 7 days receive a second email with a fresh link, valid for another 7 days.

What happens after the email is confirmed

What the data subject sees next depends on the phone verification method of the request's brand:

• Phone verification not required. The request moves from Unverified to Open, and the data subject sees a Success! page confirming their request was submitted.
• Phone verification required. The data subject goes straight to the Verify your phone number page to enter a code sent by SMS. The request stays Unverified until the code is entered. See Phone Verification.

Either way, the email confirmation is recorded in the request's audit log.

If the data subject clicks the link again after verifying, the Privacy Center tells them the request is already verified.

Following up on unverified requests

Requests waiting for email confirmation appear in the Unverified view of the Requests page. Open one to see its verification status. The Email row shows either Verified or Unverified, along with when the verification email was sent.

If a data subject says they never received the email, ask them to check their spam folder first. If emails from your brand often land in spam, consider setting up a custom email sender domain.

Requests that skip email verification

Requests created through channels other than the Privacy Center are considered verified on creation, and no verification email is sent:

• Requests added manually
• Imported requests
• Requests created through the API

Good to know

• Due date. An unverified request shows Pending verification in place of a due date until verification is complete.
• Multibrand. Each brand can send its own verification template. See Verification Email Template and Understanding Multibrand in DSR.
• Regulatory context. Email confirmation is a widely used, reasonable verification method for lower-risk requests under the CCPA regulations, and supports the identity checks GDPR Article 12(6) permits.