An opt-in is a record, not a checkbox.

A deliberate act by which someone agrees to receive email from you. In practice it is a form submission, a ticked box that started unticked, or a reply to a confirmation message. The word doing the work is deliberate: opening an account, buying something, or failing to untick a box are not, on their own, an opt-in to marketing in most regimes.

Express consent is an action whose only purpose was to say yes — typing an address into a signup form. Implied consent is permission inferred from an existing relationship, such as a recent purchase. Several jurisdictions recognise implied consent but almost all of them put a time limit on it, and the limit varies. Express consent does not expire and is far easier to evidence, which is why it is worth designing for even where the weaker form is permitted.

For marketing email, in most markets, yes — and this page is not legal advice, so take the specifics to someone qualified in your jurisdiction. The broad picture: the EU and UK require a clear affirmative act with a narrow exemption for existing customers being sold similar things; the US CAN-SPAM Act is closer to an opt-out regime but still mandates a working unsubscribe, a real postal address and no deceptive headers; Canada's CASL is stricter than either. Transactional email — order confirmations, shipping updates — is treated differently from marketing everywhere.

Not as valid consent under GDPR, which requires a clear affirmative action, and a box that was already ticked is not one. Beyond the legal position, pre-ticked boxes select for people who were not paying attention, which produces exactly the subscribers who later mark you as spam. The engagement cost usually exceeds the list-size benefit.

As little as it can. Every additional field costs completions, and most of what people ask for at signup — first name, birthday, preferences — can be collected later from someone who has already said yes. Ask for the address, say plainly what they will get and roughly how often, and link the terms and privacy policy from the form itself.

By storing the record at the time, because it cannot be reconstructed afterwards: the timestamp, the page or form, the wording shown, and the version of the terms and privacy policy in force. Double opt-in adds a second, independently verifiable event — the confirmation click — which is the strongest evidence available short of a signed document.

Directionally yes, and we are not going to attach a number to it, because every published figure comes from a vendor summarising its own customers. The mechanism is not mysterious: people who asked to hear from you open more and complain less, and complaint rate is what mailbox providers use to decide whether your mail reaches an inbox. Measure your own baseline rather than trusting anyone else's benchmark, ours included.