You verify who actually opened your document by asking for a verified email: the viewer enters a six-digit code sent to their inbox before the document opens, so every open is tied to a confirmed address rather than an anonymous click. Verified email is on Plus and above, and on every plan for a link set to "Only the people I name". A plain link tells you the document was opened somewhere. A verified link tells you which confirmed email address opened it.
Steps
- Open the [room](/glossary/virtual-data-room/) holding the document.
- Choose "Anyone who verifies an email address" in the share's access settings. A six-digit code goes to the viewer's inbox and must be entered before anything opens. This is on Plus and above; on the free tier, switch on "Only the people I name" and the link checks each named person's address the same way.
- Send the link to the intended recipient specifically. The check confirms who is opening it; it does not stop someone forwarding the link for another person to try, the same forwarding risk covered in how you un-send a document you have already shared.
- Check the document's Activity tab once it has been opened. Each visit shows the viewer's email with a Verified label, alongside pages seen and time spent.
- Look for a mismatch. If the verified email is not the person you sent it to, someone else opened it under their own address, which is exactly what the check is meant to surface.
- Add an NDA on Pro and above if you also need a signed agreement on record: the viewer verifies their email and signs before anything opens, and both sides are emailed the executed copy.
Edge cases and what to check
A verified open and an anonymous visit are not the same signal. A forwarded link opening or someone glancing for two seconds can register as "opened" on a tool that checks nothing. Our guide on views vs verified readers sets out exactly why that distinction decides whether your data is trustworthy at all.
A verified email confirms who is opening the document at that moment. It does not stop a verified viewer from forwarding the link afterwards, so if someone else clicks it next, they hit their own verification step, which is how you would spot that the document reached a second person. If you also need an NDA on record before anything opens, NDA gating is on Pro and above. Verified email itself is on Plus and above, and on the free tier, three rooms and twenty five active links, forever, with no card required, for any link set to "Only the people I name".
After sending, check that the verified email on file matches who you expected. A verified visit with almost no time usually means the person opened it and left straight away, so expect a return visit before you judge it.
Signals that tell you the open was genuine
Not every open is equally telling. A few signals, read together, tell you whether you are looking at a careful read or a quick glance. Each visit's total time is on every plan; the time on each page is from Plus.
| Signal | Suggests genuine open | Suggests a glance or a low-value open |
|---|---|---|
| Time spent | Several seconds or more, varying by page | A few seconds, or none |
| Verified identity | Matches the person you sent it to | Missing, or a domain you do not recognise |
| Number of pages reached | Several, in a plausible reading order | One page, instantly |
| Repeat visits | A second visit days later, often a good sign | Multiple identical opens seconds apart |
Reading these together matters more than any single signal on its own. A short first visit followed by a longer second visit is a completely normal pattern for someone skimming before committing to a full read, and treating it as disinterest would be the wrong call.
If your current tool cannot do this
If your current sharing tool cannot tell you who opened a document, only that it was opened, test it against this standard: does it require identity confirmation before the file loads, or does it simply log a click?
- If there is no gate at all, any link click counts as "opened", regardless of who clicked it.
- If the "opened" event fires from a preview bot or email scanning software before a human ever sees the file, your numbers are inflated from day one.
- If the tool cannot separate verified sessions from anonymous ones in its reporting, you cannot act on the data with any confidence.
Verified email works this way inside 99 Data Rooms: identity is confirmed before the document loads, and verified viewers are reported separately from raw visits on every plan. It is on Plus and above, and on every plan for links to people you name. How can you tell if an investor actually read your deck walks through the same problem in one specific, high-stakes scenario, and our roundup of tools that track who opened your PDF applies the same standard to other vendors.
One more habit worth building: check verification patterns across a whole distribution, not just one recipient. If you sent the same document to ten people as named sends, and eight have verified visits while two show none yet, that gap is itself information. It may simply mean those two have not opened it yet, which is worth knowing before you assume silence means disinterest.
Frequently asked questions
What is the difference between "opened" and "verified viewer"? "Opened" can mean a link was clicked by anyone, including a forwarded recipient. "Verified viewer" means the person confirmed their email address with a one-time code sent to it before the file loaded, so the open is attributable to a confirmed address.
Does verifying the email stop someone from forwarding my link to a colleague? No. The check confirms who is opening the document; it does not restrict who receives the link in the first place. If a colleague opens a forwarded link, they go through their own verification step, which is how you would notice a second address appearing.
Can I verify identity without requiring an NDA? Yes. Verified email works on its own, on Plus and above, and on every plan for a link set to "Only the people I name". An NDA gate, on Pro and above, adds a signed agreement on top of the verified email.
Why does a verified viewer show almost no time? A scanner cannot read the emailed code, so a verified visit came from someone with access to that inbox; very little time usually means they opened it and closed it straight away. On a link open to anyone, an automated link scanner can occasionally account for a short visit.
Do I need a paid plan to verify who opened a document? Verified email is on Plus and above. On the free tier, three rooms and twenty five active links with no card required, a link set to "Only the people I name" checks each named person's email with a one-time code, and any other link can ask for an email address, which records who said they opened it.
Know who is actually reading it
Stop treating a click as proof someone read your document. Name the people you are sending to from a room on the free tier, three rooms and twenty five active links, no card needed, switch on "Only the people I name", and each one verifies their email before it opens. Start free and check the verified identity behind your next open.
Sources
- Gating and verified-viewer tracking behaviour reflect 99 Data Rooms product facts.