Double opt-in catches three failure modes that single opt-in misses: typos in the submitted address, malicious sign-ups using someone else's email, and bot-submitted form spam. Each one would otherwise generate hard bounces or spam reports — both of which damage your sender reputation.
The trade-off is conversion rate at the sign-up. Typically 10–30% of single-opt-in sign-ups never confirm — they meant to subscribe but never opened the confirmation. Some teams treat this as a cost worth paying; others use single opt-in with aggressive bounce handling.
Regulatory context: GDPR (EU) and CASL (Canada) effectively require opt-in proof, which double opt-in satisfies cleanly. The US (CAN-SPAM) does not require it but does require honoring unsubscribes promptly. The safest default for any global list is double opt-in.