How can I get Double Opt in to work when using a Profile for to create a user/contact

Question

Wordpress 4.9.8, CiviCRM 5.6.0

I'm in Wordpress trying to use CiviCRM profile forms to capture information from users for registration. At the same time, this will create their Wordpress user.

However, CiviCRM lets you create any user you want, with any available email, using a profile page without getting any confirmation via an email address...

Surely this puts us in violation of some of the newer GDPR laws?

The only double opt in that happens is if you use the option to add someone to a group and it sends them an opt in mail. This is pretty useless since it's just let you create a user with any email address you want.

This seems to let the system be open for abuse.

Am I missing a setting somewhere?

Thanks, Norman

Answer 1

I would like to comment on Jon G's answer, unfortunately this seems not to be possible directly after sign-up to stackexchange:

Basically, I have the same problem by accepting memberships with pay later option (payments via invoice). Anyone can sign up and have someone sent a membership invoice via e-mail.

I just tried the "Email verification on signup" plugin, but with no success: It messes with the groups plugin, which I am using to sync CiviCRM memberships with wordpress accounts. This plugin assigns all newly registered users to the "registered" group. However, unfortunately not the ones which get processed via the new verification plugin.

Anyways, this would only be half of the solution, since the confirmation needs to be propagated back to the CiviCRM database BEFORE sending out e-mails with invoices.

So, basically I am also searching for the right answer on how to prevent bogus sign-ups to trigger unsolicited E-Mails, which could indeed be regarded as non GDPR-compliant.

Currently, this answer might be a customization with an additional membership state like "pending_unverified" which would be transformed into "pending" after successful verification of the provided e-mail. However, this sounds like a lot of work.

---

Update: @petednz - thanks a lot!

I just tried something different (again, rather a comment than a solution):

Given that adding a member to a group will trigger the double opt-in, I defined a new group, to which all new members are automatically added while creating their wordpress profile. My hope was, to receive a confirmation request for the e-mail address and have at least the confirmation on record, even if member access to wp pages would be possible w/o confirmation.

Unfortunately, no confirmation link was sent out by CiviCRM. Instead, no username/password could be set for the wordpress account. Instead, the new member is logged into wordpress and receives also an e-mail with the request to set a new password. While this, in theory, can be seen as kind of a confirmation of the e-mail address, there is nothing on record within the CiviCRM system. I am now a bit confused, how not even addition to a group will trigger the confirmation precedure. I will have to dig deeper into this during the next weeks.

Just to sum up, what I originally tried to achieve:

• new member registers online and will pay later
• he provides his e-mail address during the registration
• he receives an e-mail with a confirmation link to confirm his e-mail address (this is logged for GDPR purposes within the system)
• once this is done, an e-mail with an invoice is sent to him
• upon receipt of payment, membership status goes from pending to new as usual

Answer 2

I think the easiest solution would be for WordPress to send an email to confirm the user registration. Perhaps an extension like Email verification on signup or Pie Register would meet your needs here.