How fast do I have to honour an unsubscribe?

CAN-SPAM and CASL both allow 10 business days, but Google asks bulk senders to process requests within two days, so the practical target is the shorter one. Suppression that takes effect before the next scheduled send satisfies every version of the requirement at once.

Does a reply saying stop count as an unsubscribe?

Legally, yes. An objection does not need particular wording or a form, and CAN-SPAM expressly allows a reply email as the mechanism. Operationally it only counts if someone reads the reply and suppresses the address, which is why replies containing an opt-out are worth detecting automatically rather than by hand.

Do I need an unsubscribe link in a one-to-one cold email?

A genuinely individual message is treated differently from a bulk send under the mailbox provider rules, but the legal position still requires a clear way to opt out of commercial messages, and CASL requires a compliant mechanism in each one. An opt-out line costs nothing and removes the argument.

JaxSuite AI

What Is the Unsubscribe Requirement?

TL;DR

The unsubscribe requirement is the obligation to give recipients a working way to stop your email and to act on it. CAN-SPAM allows 10 business days and requires the mechanism to work for at least 30 days after sending, CASL sets 10 business days with a 60-day mechanism, and a GDPR marketing objection is absolute.

What does the law require?

CAN-SPAM requires a clear and conspicuous explanation of how to opt out, honouring within 10 business days, and a mechanism able to process requests for at least 30 days after the message was sent. It also caps what you may demand: no fee, no personal information beyond an email address, and nothing more effortful than a reply or a single web page. Once someone opts out, their address may not be sold or transferred.

CASL section 11 sets a 60-day minimum validity for the unsubscribe address or link and requires the request to be given effect without delay and no later than 10 business days, with no further action needed from the person. GDPR takes a different shape: Article 21(2) and (3) make an objection to direct marketing absolute, so processing for that purpose simply stops. PECR requires an opt-out in every message, including messages to corporate subscribers who needed no consent to receive the first one.

What do the mailbox providers require?

A separate set of rules, enforced faster than any regulator. Google treats senders of more than 5,000 messages a day to Gmail as bulk senders and requires marketing and subscribed messages to support one-click unsubscribe through the List-Unsubscribe and List-Unsubscribe-Post headers described in RFC 8058, alongside a clearly visible unsubscribe link in the body. Requests have to be processed within two days.

Yahoo introduced the same expectation alongside Google in 2024, and Microsoft extended one-click unsubscribe to its consumer domains in May 2025. Failing these does not produce a fine, it produces filtering, which is why they bind in practice long before a legal deadline does.

Which deadline actually governs your sending?

The shortest one that applies. Processing within two days satisfies 10 business days automatically, so building to the mailbox provider requirement clears the statutory ones without a second workflow. The published figures above are the rules as they stand rather than advice on your own programme, and which regimes reach a given list is worth confirming with a lawyer.

The part that has to work mechanically is suppression. An opt-out recorded against a single campaign, rather than against the account, is the reason people receive a second sequence after asking to be left alone, and that is read as bad faith regardless of which deadline was technically met.

FAQ

Frequently asked questions

CAN-SPAM and CASL both allow 10 business days, but Google asks bulk senders to process requests within two days, so the practical target is the shorter one. Suppression that takes effect before the next scheduled send satisfies every version of the requirement at once.