What are the CAN-SPAM and CASL requirements for unsubscribe confirmation pages, preference updates, and email re-entry?

Summary

CAN-SPAM and CASL regulations necessitate clear, easily accessible, and frictionless unsubscribe mechanisms in commercial emails. Unsubscribe requests must be honored within 10 business days. CAN-SPAM's mechanism must be active for 30 days post-transmission, while CASL requires 60 days. While some legislation might allow requiring email address entry for older lists, it's strongly discouraged. Using secure tokens in unsubscribe links is critical to prevent unauthorized list manipulation. Offering preference centers as alternatives to complete opt-out is beneficial, provided a clear unsubscribe option is also available. Unsubscribes should apply globally. CAN-SPAM primarily targets commercial messages. Failing to comply can lead to significant penalties and damage sender reputation. CASL applies to Canadian residents, regardless of sender location. Ensure the unsubscribe process is simple, free, and avoids 'dark patterns'. Regularly update subscriber lists.

Key findings

  • Easy Unsubscribe: Unsubscribing must be simple, preferably one-click, to reduce friction and complaints.
  • 10-Day Rule: Unsubscribe requests must be processed within 10 business days under both CAN-SPAM and CASL.
  • Mechanism Duration: CAN-SPAM requires unsubscribe mechanisms active for 30 days; CASL requires 60 days.
  • Secure Tokens: Use secure tokens in unsubscribe links to prevent unauthorized list manipulation.
  • Preference Centers: Offering preference centers as an alternative to complete opt-out can reduce unsubscribes.
  • Global Unsubscribe: Unsubscribes should apply globally across all email types.
  • Commercial Focus: CAN-SPAM primarily targets commercial messages.
  • CASL Scope: CASL applies to commercial emails sent to Canadian residents, regardless of sender location.
  • Avoid Re-Entry: Re-entering email addresses for unsubscribing should be avoided if an authenticated token is used.

Key considerations

  • Legal Penalties: Non-compliance with CAN-SPAM and CASL can lead to significant fines and legal consequences.
  • Sender Reputation: Failing to respect unsubscribe requests damages sender reputation.
  • Third-Party Compliance: Ensure third-party email marketing vendors also comply with CAN-SPAM and CASL.
  • Subscriber Consent: CASL requires either express or implied consent; unsubscribing revokes implied consent.
  • List Hygiene: Regularly update subscriber lists to remove unsubscribed recipients to avoid penalties.
  • Transparent Practices: Employ transparent unsubscribe practices, avoiding 'dark patterns' that trick users into staying subscribed.
  • '+' Tag support: Make sure to implement '+tag' support in the email address logic
  • Commercial emails: Make sure the email meets the requirements for commercial emails

What email marketers say
14Marketer opinions

CAN-SPAM and CASL regulations mandate clear and easily accessible unsubscribe mechanisms in commercial emails. These mechanisms must be honored promptly (within 10 business days under both laws), be functional for a specified period (30 days under CAN-SPAM, 60 days under CASL), and not require excessive steps or re-entry of information. Best practices include providing a one-click unsubscribe option, making the unsubscribe link obvious, avoiding dark patterns, and offering preference centers as an alternative to complete opt-out. Compliance is crucial for maintaining a good sender reputation and avoiding penalties.

Key opinions

  • Easy Unsubscribe: Unsubscribing must be simple, ideally with a one-click option to reduce friction and complaints.
  • Time Limit: Unsubscribe requests must be processed within 10 business days under both CAN-SPAM and CASL.
  • Preference Centers: Offering a preference center where users can manage their subscriptions can reduce the number of complete unsubscribes.
  • Global Unsubscribe: Unsubscribes should apply globally to all email types unless the user specifically chooses to manage preferences.
  • CASL Scope: CASL applies to any commercial email sent to a Canadian resident, regardless of where the sender is located.
  • Data Integrity: Ensure email addresses with '+' tags are properly handled during the unsubscribe process.

Key considerations

  • Subscriber Rights: Respecting subscriber rights and preferences is essential for maintaining a good sender reputation.
  • Legal Compliance: Failure to comply with CAN-SPAM and CASL can result in significant fines and legal consequences.
  • Third-Party Compliance: If you hire a third party to handle email marketing, ensure they also comply with CAN-SPAM and CASL.
  • Preference Updates: Do not require any action beyond visiting a webpage, entering an email address and taking a single action (clicking a button).
  • List Hygiene: Regularly update subscriber lists to remove unsubscribed recipients.
  • Transparency: Avoiding dark patterns and ensuring transparency in the unsubscribe process build trust.
Marketer view

Email marketer from Email Geeks explains that the harder it is to unsubscribe, the more complaints you will get. Having to re-enter the email address adds too much friction.

September 2023 - Email Geeks
Marketer view

Email marketer from Zoho states that under the CAN-SPAM Act, it is crucial to monitor what others are doing on your behalf. You're responsible for ensuring that anyone you hire to handle your email marketing complies with the law. Therefore, make sure they comply with all unsubscribe requirements.

January 2023 - Zoho
Marketer view

Email marketer from Email Geeks explains that when you create the logic behind your unsub, make sure it accepts addresses with the `+` tag. He personally bristles when I cannot unsub his address because the logic replaces the `+` character with a space.

September 2023 - Email Geeks
Marketer view

Email marketer from EmailToolTester explains that CASL applies to any commercial email sent to a Canadian resident, regardless of where the email is sent from. Therefore, if you have Canadian subscribers, you must comply with CASL, including the unsubscribe requirements.

December 2024 - EmailToolTester
Marketer view

Email marketer from Litmus recommends providing a preference center where subscribers can manage their email frequency or topics. However, also include a prominent one-click unsubscribe option for those who want to opt out completely. CAN-SPAM allows for preference centers as long as a clear opt-out is also provided.

January 2022 - Litmus
Marketer view

Email marketer from Email Geeks says to put the 'stop all email button' at the top or at least extremely obvious. Too many subscription preference pages have the full opt out as the last option on the page, and in the smallest font

November 2021 - Email Geeks
Marketer view

Email marketer from Sender explains the importance of easily accessible unsubscribe links and avoiding dark patterns that might trick users into staying subscribed. They emphasize transparency and giving users control over their subscription preferences.

May 2023 - Sender
Marketer view

Email marketer from ActiveCampaign shares that its important to remember that unsubscribes must apply globally across all email types if that's what the user intends. Don't make users unsubscribe from each list individually, unless they specifically choose to manage preferences instead.

October 2021 - ActiveCampaign
Marketer view

Email marketer from Email Geeks says that re-entering email will only increase complaints. There should be no reason not to include email (hashed obv) other than a tooling setup issue.

May 2022 - Email Geeks
Marketer view

Email marketer from Mailjet shares that best practice is to make unsubscribing as simple as possible. This generally includes a one-click unsubscribe option. CAN-SPAM requires honoring unsubscribe requests within 10 days and making the mechanism available for 30 days after sending.

July 2023 - Mailjet
Marketer view

Email marketer from Campaign Monitor recommends always including a visible and working unsubscribe link in every email. Make sure it is easy to find and understand. Don't hide it in small print or use confusing language.

July 2023 - Campaign Monitor
Marketer view

Email marketer from Automizy explains that CASL mandates a clearly displayed unsubscribe mechanism in every commercial email. This mechanism must be easy to use and allow recipients to unsubscribe immediately. You must comply with the request within 10 business days.

August 2022 - Automizy
Marketer view

Email marketer from Hubspot explains that CASL requires either express or implied consent to send commercial emails. The unsubscribe mechanism is especially crucial for managing implied consent. If someone unsubscribes, you can no longer send them emails based on implied consent.

May 2023 - HubSpot
Marketer view

Email marketer from Pardot recommends building an email preference center to allow users to manage their email subscriptions. This helps avoid unsubscribes by giving them more control. Make sure the option to unsubscribe from all emails is still readily available.

March 2024 - Pardot

What the experts say
5Expert opinions

Experts emphasize the importance of straightforward unsubscribe processes in compliance with CAN-SPAM and CASL. While legislation might allow for requiring an email address to grandfather old lists, it's highly discouraged. An unsubscribe link should include a secure token to prevent unauthorized subscription modifications. Offering options to opt-down instead of out is acceptable, provided there's a clear option to stop all emails. Requiring more than a single click to unsubscribe is not permissible. CAN-SPAM mainly targets commercial messages. One-click unsubscribes are crucial, with a focus on minimizing friction to protect sender reputation and avoid deliverability issues.

Key opinions

  • Discouraged Practice: Requiring email address entry for unsubscribing is discouraged, even if legally permissible for grandfathered lists.
  • Security Tokens: Unsubscribe links should include secure tokens to prevent unauthorized modifications.
  • Opt-Down Options: Offering opt-down alternatives is acceptable as long as a clear 'stop all emails' option exists.
  • Single Click: CAN-SPAM focuses primarily on commercial messages and should not require more than a single click to unsubscribe.
  • Commercial vs. Transactional: CAN-SPAM's unsubscribe requirements mainly apply to commercial emails, not transactional ones.
  • Minimize Friction: Easy, one-click unsubscribes minimize friction, protect sender reputation, and improve deliverability.

Key considerations

  • Token Security: Ensure the identity tokens used cannot be iterated through to dump your entire list.
  • Intent: Assess your intent with requiring any further information to unsubscribing.
  • Message Type: Determine if your message qualifies as a commercial email.
  • One Click Emphasis: Offer a clear 'stop all email' button, preferably at the top, and easy unsubscribing to protect sender reputation.
  • User Experience: Ensure it is clear the user experience for unsubscribing is of a good quality
Expert view

Expert from Email Geeks shares that offering to let people opt-down instead of out is fine as long as there’s a clear “stop all email” option. Asking for an optional “why did you unsubscribe” is fine, requiring it isn’t. You CANNOT require any action beyond visiting a web page, entering an email address and taking a single action (click the button). You SHOULD NOT require entering the email address.

April 2023 - Email Geeks
Expert view

Expert from Email Geeks mentions legislation allows requiring the email address to grandfather in old mailing lists with static unsubscribe pages but advises against it. If you don’t include an opaque or authenticated token in the unsub link, others can modify subscriptions if they know the email address. Asking for the email address when you have a token means you’re either incredibly incompetent or just being a dick about it.

April 2024 - Email Geeks
Expert view

Expert from Spamresource explains that CAN-SPAM primarily targets commercial messages, meaning its unsubscribe requirements are most critical for emails advertising or promoting a product or service. Transactional messages are excluded.

March 2025 - Spamresource
Expert view

Expert from Word to the Wise explains the significance of easy, one-click unsubscribe options and the consequences (e.g. spam complaints, sender reputation damage, deliverability issues) of not respecting subscriber preferences. It emphasizes avoiding friction in the unsubscribe process.

August 2024 - Word to the Wise
Expert view

Expert from Spamresource clarifies the definition of 'commercial email' under CAN-SPAM. It is defined as any electronic mail message, the primary purpose of which is the commercial advertisement or promotion of a commercial product or service. Understanding this definition is crucial in determining whether the unsubscribe requirements apply to a given email.

June 2022 - Spamresource

What the documentation says
5Technical articles

Both CAN-SPAM and CASL mandate clear and conspicuous unsubscribe mechanisms for commercial emails. CAN-SPAM requires honoring opt-out requests within 10 business days, with the mechanism active for at least 30 days. CASL also requires processing unsubscribe requests within 10 business days, but the mechanism must remain functional for 60 days. The process must be simple, free of charge, and shouldn't require logins or extensive personal information. Regularly updating subscriber lists and ceasing communication with those who have unsubscribed is vital to avoid penalties.

Key findings

  • Opt-Out Clarity: CAN-SPAM mandates a clear and conspicuous explanation of how recipients can opt out.
  • 10-Day Rule: Both CAN-SPAM and CASL require honoring unsubscribe requests within 10 business days.
  • Mechanism Duration: CAN-SPAM: mechanism active for at least 30 days. CASL: mechanism active for at least 60 days.
  • Simplicity: Unsubscribe processes must be simple, free, and not require logins or excessive data.
  • List Hygiene: Regularly update subscriber lists to remove unsubscribed recipients.
  • No Cost: There must be no fee to unsubscribe.

Key considerations

  • Penalties: Continuing to email those who have unsubscribed can lead to significant penalties.
  • Jurisdictional Scope: Understand whether CAN-SPAM, CASL, or both apply to your email marketing activities based on recipient location.
  • Accessibility: Ensure the unsubscribe mechanism is easily accessible and usable for all recipients.
  • Prompt Action: Prioritize prompt processing of unsubscribe requests.
  • Process Visibility: Ensure unsubscribe mechanisms set out clearly and prominently.
  • Commercial emails: Ensure the email meets the requirements for commercial emails
Technical article

Documentation from Federal Trade Commission explains that the CAN-SPAM Act requires a clear and conspicuous explanation of how the recipient can opt out of receiving future emails from you. The process can be by a return email address or another internet-based way. Also, the sender must honor opt-out requests promptly, within 10 business days, and the mechanism must be active for at least 30 days after transmission.

May 2024 - Federal Trade Commission
Technical article

Documentation from Canadian Radio-television and Telecommunications Commission specifies that the unsubscribe mechanism must be set out clearly and prominently, and be easy to use. The recipient shouldn't have to pay a fee, and the unsubscribe request has to be processed within 10 business days.

August 2021 - Canadian Radio-television and Telecommunications Commission
Technical article

Documentation from Sendinblue notes that under CASL, the unsubscribe link must be functional for at least 60 days after the email is sent. You need to process unsubscribe requests promptly and at no cost to the recipient. Ensure the unsubscribe process doesn't require recipients to log in or provide personal information beyond their email address.

December 2021 - Sendinblue
Technical article

Documentation from Competition Bureau Canada explains that CASL requires all commercial electronic messages (CEMs) to include an unsubscribe mechanism that allows recipients to easily opt-out of receiving future messages. The unsubscribe mechanism must be functional for 60 days after the message is sent. The sender must process the unsubscribe request without delay, and no later than 10 business days after it is made.

October 2023 - Competition Bureau Canada
Technical article

Documentation from U.S. Small Business Administration states that its important to regularly update your subscriber list to remove those who have unsubscribed. Under CAN-SPAM, continuing to send emails to someone who has opted out can result in significant penalties.

January 2022 - U.S. Small Business Administration