Do they need to confirm their email... twice?

Question

My site sends reminder emails to users 2-5 years in the future. Users log in via a 3rd party API. The third party gives me the name, email, phone, etc. of the user when they log into my site. What I have been doing is sending a confirmation email in the background but letting the user use the site even though their email isn't validated with us.

I am now wondering why I am making the users confirm their email because it doesn't affect their ability to use the site; we will still send them a reminder even if they haven't confirmed their email. The only reason I can come up with is because we ask the user to take a survey (about them to help us identify our audience) after they confirm their email.

I am wondering if I should just get rid of the email confirmation process altogether. I am sure the 3rd party verifies the users email. The thing I am worried about, however, is our emails being marked as spam by the user's email application. The reminders we send out are very important; so important that if the user doesn't take action on the reminder after a few weeks (of re-sending the reminder every few days) we take action and try reaching out to them by phone. Recently we have been getting quite a few reminders that never had action taken and we had to call every user that didn't take action on their reminder.

Is there some way that we could be reassured that our emails wouldn't go to spam? It seems pointless to me to have the user confirm their email when it has already been confirmed by the 3rd party and it honestly doesn't matter if they have confirmed their email; they can still use our application. Any suggestions?

Answer 1

Confirmation in your case is necessary since else, it would become an easy way to spam emails to a list of emails with a bot without needing confirmation.

Since the process of reminders can be automated after a single 3rd party API login and iterated with an array of emails, it will become very easy to exploit such a service and send reminder emails to others.

From your side, I strongly believe you need to only send reminders if they have confirmed it from their email. Third party authentication will be necessary in your case due to the details.

So, as far as UX is concerned, it might add up as an extra step to be done. But it also ensures that your service isn't exploited by a bot and isn't dependent on the 3rd party API.

Answer 2

If you trust that the email you retrieve from the 3rd party API is valid for the user, and you don't have "someone from marketing" forcing you to make the user re-confirm their email (so that they can be "gently spammed" in the form of a confirmation email that just so happens to contain some sort of marketing messaging or upsell), then (in answer to your primary question) I don't believe you should make them jump through extra hoops.

As to your question about your emails going to spam, I can't help you: I don't know anything about the content of the email they're sending to their future selves, but if they send something that their future-self's spam algorithm detects as spam, there's not much you can do about that.

Bottom line: it sounds like you have already decided to keep the friction low by letting them use your service without confirming their already-confirmed emails with you, and I endorse that decision.

Answer 3

In general, the result of survey for 90% of your website users will give the same results of 30%. Example, if you run a survey on 30% of users and you find the average user spend 10 minutes on your website, this value will not change too much if run it on 90% of users. I think there is no need to confirm email for all users if you only using it for survey.