We've just started using Drupal webform to offer a front-end to our email subscribers sign up form. Because we offer a number of different newsletters in different languages, we have a number of checkboxes to opt into these. In CiviCRM we run smart groups to gather up who receives which newsletter. Users are also added to a generic "subscribers" group when they click the confirmation link they receive in their email.
I just realised that this means that we're effectively bypassing the confirmation email phase. We could feasibly end up sending newsletters to people who haven't opted into them. Is there a way to configure this so that either a) no data is added to CiviCRM until the user clicks the confirmation link or b) users are set to "on hold" until they click the confirmation link?