How should one-click unsubscribe links handle GET vs POST requests?
Summary
What email marketers say10Marketer opinions
Email marketer from Campaign Monitor indirectly supports the use of POST via a confirmation page and best practice. They recommend enabling double opt out so that users have to re-confirm this is what they want to do.
Email marketer from Mailjet explains the need to adhere to best practice and strongly recommend POST requests over GET requests to ensure unintended users do not get opted out.
Email marketer from Reddit shares that using GET requests can lead to accidental unsubscriptions when email clients pre-fetch links. They suggest always using POST requests with a confirmation page to ensure the user intended to unsubscribe.
Email marketer from Email Deliverability blog shares that GET requests can be followed by bots which would result in unsubscribes.
Email marketer from Litmus recommends providing a clear and accessible unsubscribe link, leading to a confirmation page. They recommend against direct GET-based unsubscriptions and implies the need for a POST to confirm the opt-out.
Email marketer from Email Marketing Forum notes that some email clients might automatically trigger GET requests on unsubscribe links. They recommend using a POST request to a confirmation page to prevent unintended opt-outs.
Email marketer from SendGrid emphasizes the importance of respecting unsubscribes. Their guidance indirectly supports using POST requests by recommending a clear unsubscribe process with a confirmation page to avoid accidental unsubscriptions.
Email marketer from Email on Acid emphasizes the importance of a clear unsubscribe process. While not explicitly discussing GET vs. POST, their guidance suggests that an unsubscribe process should involve a confirmation step, pointing towards POST requests being more appropriate for final unsubscription.
Email marketer from Stack Overflow advises against using GET requests for unsubscribe links. They explain that GET requests can be triggered by various automated systems and could lead to unintended unsubscriptions. POST requests are better suited to prevent such issues.
Email marketer from HubSpot advises on having a double opt out for users, and recommends that the end point for opting out requires confirmation and is not just a GET request.
What the experts say3Expert opinions
Expert from Spam Resource, referencing M3AAWG documentation, mentions that it is undesirable to require an image load to unsubscribe. Therefore avoid GET requests which may cause issues with automated clients.
Expert from Word to the Wise explains that for one-click unsubscribe, utilizing a POST request ensures a more secure and intentional opt-out process, preventing unintended unsubscriptions often associated with GET requests.
Expert from Email Geeks explains that visiting the unsubscribe link in a browser (GET request) should display a page giving the user the opportunity to opt out, it shouldn’t unsubscribe unless it’s a POST request.
What the documentation says4Technical articles
Documentation from Mailchimp explains that the List-Unsubscribe header should contain a mailto: address and/or an HTTP URL. While they don't explicitly forbid GET requests, they imply that URLs should lead to a page where the user can confirm their unsubscription, suggesting a POST request for the final action.
Documentation from RFC Editor specifies that one-click unsubscribe SHOULD be implemented using HTTP POST requests. This method ensures that the unsubscribe action is an explicit intent of the user, mitigating accidental unsubscriptions caused by automated link checkers or crawlers.
Documentation from SparkPost notes the need to comply with best practice unsubscribe methods. They strongly recommend using POST for final unsubscribe requests to mitigate against unintended consequences.
Documentation from Microsoft (Sender Support) encourages best practices with handling unsubscribe, this would include confirmation pages, confirmation emails and POST requests.