Should Online Voting Require Email Verification?
Published 18 August 2026 · 5 min read · Explainer
In short
Require email verification when the vote decides something of real value — a scholarship, a cash prize, a title people will contest — and skip it when the vote is for engagement or fun. Verification meaningfully raises the cost of manufacturing votes, but it also reduces turnout at every step, and it turns the organiser into a holder of personal information with privacy obligations attached.
Email verification is the most commonly recommended and least commonly examined control in online voting. It genuinely works against certain attacks and does nothing against others, and it always costs voters. Whether that trade is worth making depends entirely on what the vote decides — which means the answer is different for a school art show and a scholarship pageant.
What does email verification actually prevent?
It raises the cost of creating additional voters. That is a narrower claim than it usually gets, and worth being precise about.
| Behaviour | Stopped? | Why |
|---|---|---|
| Casual repeat voting from a private window | Yes | A new address is needed each time |
| Basic scripted voting | Largely | The script must now receive and act on emails |
| Voting from multiple devices by one person | Yes, unless they hold several addresses | The vote is tied to the address, not the device |
| Disposable email services | No | Free throwaway addresses are trivial to generate |
| Organised human voting | No | Every voter is real and has a real address |
| Determined attackers | No | Bulk addresses are cheap to obtain |
Read the bottom three rows together: verification defeats convenience, not determination. It is a friction control, and pricing it accurately is what makes the decision straightforward.
What does it cost in turnout?
Real turnout, at several points. Every additional step between arriving and voting loses people, and email verification adds more than one.
- Some voters decline to give an email address at all
- Some enter one and never open the confirmation
- Some confirmations land in spam and are never seen
- Some voters are on a phone, in a different app, and lose the thread entirely
- Some try later and forget
The loss is concentrated among casual supporters — precisely the marginal voters a campaign works hardest to reach. Committed supporters will complete verification; the friend of a friend will not.
When is it worth requiring?
| The vote decides | Recommended | Reasoning |
|---|---|---|
| Fun, engagement, no prize | No verification | Friction costs more than manipulation would |
| A sash, title or recognition | Optional; per-day limits often enough | Moderate stakes, moderate controls |
| A scholarship, cash or significant prize | Yes | The incentive to manufacture votes is now material |
| A finalist place or competitive advantage | Yes | Public voting now affects the judged competition |
| A members-only decision | Account-based instead | Membership, not just an inbox, is what matters |
| A fundraising outcome | Paid voting instead | Payment is stronger verification than email |
Voorna lets organisers set the free-vote limit per event, so the level can be matched to what each competition decides rather than fixed platform-wide.
What obligations does collecting emails create?
Requiring an email address turns you into a holder of personal information, with duties that apply wherever your voters are.
- Say why you are collecting it on the voting page, before it is entered
- Use it only for that purpose — voter addresses are not a marketing list unless people agreed to that separately
- Store it securely and restrict who can see it
- Keep it only as long as needed, then delete it
- Be able to respond if someone asks what you hold about them
New Zealand's Privacy Act 2020 sets out thirteen information privacy principles covering exactly this, and requires notification of breaches likely to cause serious harm. Australia applies the Australian Privacy Principles, the United Kingdom applies UK GDPR, and several US states have their own statutes. If your voters may include children, additional rules apply — see online voting for school competitions.
What are the alternatives?
- 1Per-day vote limits. No data collected, meaningful bound on any one person's contribution, zero friction.
- 2Rate limiting and per-connection caps. Invisible to legitimate voters, effective against volume.
- 3Account-based voting. Stronger than email and appropriate for member votes; highest drop-off.
- 4Paid voting. Payment verifies more strongly than any email confirmation, where charging is appropriate.
- 5A shorter voting window. Reduces the time available for organised manipulation at no cost to voters.
- 6Reducing what the vote decides. Removes the incentive rather than resisting it.
The first two are free in turnout terms and should be on by default. Reach for verification when the stakes justify the loss, not as a reflex.
If you do verify, how do you keep the loss low?
- Say up front that a confirmation email is coming, so people expect it
- Send it immediately — delays of even a minute cost completions
- Use a clear sender name and subject line so it survives spam filtering
- Keep the confirmation link to a single tap with no further form
- Return the voter to the entrant they were voting for, not to a generic page
- Tell them their vote counted, explicitly
- Let a returning voter vote again without repeating verification
That last point matters most for per-day voting: a supporter asked to verify every day will stop after two.
Frequently asked questions
- Does email verification stop bots?
- It stops simple ones, because the script must now receive and act on a confirmation email. It does not stop tooling built around disposable email services, which generate throwaway addresses at negligible cost. Treat it as raising the price of manufacturing votes rather than as a barrier.
- How much turnout does email verification cost?
- Enough to matter, though the figure depends heavily on your audience and on how the confirmation is implemented. The loss concentrates among casual supporters rather than committed ones. Measure it on your own audience by running one category verified and one open rather than relying on a general number.
- Can we use voters' email addresses for marketing afterwards?
- Not without separate, clear consent obtained at the time. Addresses collected to verify a vote were given for that purpose, and repurposing them breaches privacy expectations in every market Voorna serves — and privacy law in most of them.
- Should voters have to create an account instead?
- Only for member votes, internal awards, or titles carrying substantial value. Account creation is the strongest identity signal available short of payment, and it has the highest drop-off of any control. For a public campaign it usually costs more turnout than the added certainty is worth.
Sources
- Privacy Act 2020 — New Zealand Legislation. The thirteen information privacy principles and the notifiable privacy breach regime in New Zealand.
- Australian Privacy Principles — Office of the Australian Information Commissioner (OAIC). The Australian framework governing collection, use and retention of personal information.
- A guide to lawful basis — Information Commissioner's Office (UK). The requirement under UK GDPR to identify a lawful basis before processing personal data such as voter email addresses.
- OAT-016 Skewing — OWASP Foundation. Automated voting as the threat email verification is intended to raise the cost of.
Want to set the level per competition rather than platform-wide? Voorna applies your free-vote limit, a cooldown and a daily cap on every vote.
See Voorna's voting controls