How can I get Double Opt in to work when using a Profile for to create a user/contact
I would like to comment on Jon G's answer, unfortunately this seems not to be possible directly after sign-up to stackexchange:

Basically, I have the same problem by accepting memberships with pay later option (payments via invoice). Anyone can sign up and have someone sent a membership invoice via e-mail.

I just tried the "Email verification on signup" plugin, but with no success: It messes with the groups plugin, which I am using to sync CiviCRM memberships with wordpress accounts. This plugin assigns all newly registered users to the "registered" group. However, unfortunately not the ones which get processed via the new verification plugin.

Anyways, this would only be half of the solution, since the confirmation needs to be propagated back to the CiviCRM database BEFORE sending out e-mails with invoices.

So, basically I am also searching for the right answer on how to prevent bogus sign-ups to trigger unsolicited E-Mails, which could indeed be regarded as non GDPR-compliant.

Currently, this answer might be a customization with an additional membership state like "pending_unverified" which would be transformed into "pending" after successful verification of the provided e-mail. However, this sounds like a lot of work.



Update: 
@petednz - thanks a lot!

I just tried something different (again, rather a comment than a solution):

Given that adding a member to a group will trigger the double opt-in, I defined a new group, to which all new members are automatically added while creating their wordpress profile. My hope was, to receive a confirmation request for the e-mail address and have at least the confirmation on record, even if member access to wp pages would be possible w/o confirmation.

Unfortunately, no confirmation link was sent out by CiviCRM. Instead, no username/password could be set for the wordpress account. Instead, the new member is logged into wordpress and receives also an e-mail with the request to set a new password. While this, in theory, can be seen as kind of a confirmation of the e-mail address, there is nothing on record within the CiviCRM system. I am now a bit confused, how not even addition to a group will trigger the confirmation precedure. I will have to dig deeper into this during the next weeks.

Just to sum up, what I originally tried to achieve:


new member registers online and will pay later
he provides his e-mail address during the registration
he receives an e-mail with a confirmation link to confirm his e-mail address (this is logged for GDPR purposes within the system)
once this is done, an e-mail with an invoice is sent to him
upon receipt of payment, membership status goes from pending to new as usual