The US CANSPAM Act of 2003 does not require an opt-in approach, only an easy opt-out system. But opt-in is required by law in many European countries and elsewhere. It turns out that confirmed opt-in is the only way that you can prove that a person actually opted in, if challenged legally. Instead of giving people the option to be put in the list, they are automatically put in and then have the option to request to be taken out. This approach is illegal in the European Union and many other jurisdictions. Email address authentication is a technique for validating that a person claiming to possess a particular email address actually does so. This is normally done by sending an email containing a token to the address, and requiring that the party being authenticated supply that token before the authentication proceeds. The email containing the token is usually worded so as to explain the situation to the recipient and discourage them from supplying the token (often via visiting a URL) unless they in fact were attempting to authenticate. For example, suppose that one party, Alice, operates a website on which visitors can make accounts to participate or gain access to content. Another party, Bob, comes to that website and creates an account. Bob supplies an email address at which he can be contacted, but Alice does not yet know that Bob is being truthful (consciously or not) about the address. Alice sends a token to Bob's email address for an authentication request, asking Bob to click on a particular URL if and only if the recipient of the mail was making an account on Alice's website. Bob receives the mail and clicks the URL, demonstrating to Alice that he controls the email address he claimed to have. If instead a hostile party, Chuck, were to visit Alice's website attempting to masquerade as Bob, he would be unable to complete the account registration process because the confirmation would be sent to Bob's email address, to which Chuck does not have access. Wikipedia uses this mechanism too. The step of email address verification (confirmation) is considered by many anti-spam advocates to be the minimum degree necessary for any opt-in email advertising or other ongoing email communication.