CAN-SPAM does not require one-click unsubscribe, or even a link. It requires a working reply address or other Internet-based opt-out, shown clearly in every commercial email, that keeps working for 30 days after you send, and it gives you 10 business days to stop emailing anyone who uses it. One-click is Google’s and Yahoo’s rule for bulk senders, and both want those requests honored within two days.
On 26 October 2026 I asked Google whether CAN-SPAM requires one-click unsubscribe, and its AI Overview answered yes. That mistake cuts both ways for a cold email team. A plain-text sequence with no opt-out line breaks the law even though it has no links, and a sequence that says “reply stop” needs someone reading the replies in every one of its 40 sending inboxes.
The law asks for a way out that still works 30 days later. Gmail asks for one click. They are different rules with different clocks.
Key numbers
| Item | Number |
|---|---|
| CAN-SPAM time to honor an opt-out (from receipt of the request) | 10 business days |
| How long the opt-out route must keep working (after each email is sent) | 30 days |
| Web pages a recipient can be asked to visit to opt out (or a reply email; no fee or login) | 1 |
| Most the FTC can seek per violating email | $53,088 |
| Verkada CAN-SPAM penalty, August 2024 (the largest the FTC had obtained) | $2.95 million |
| Experian opt-out settlement, August 2023 | $650,000 |
| Gmail bulk sender threshold, personal Gmail accounts (per primary domain) | About 5,000 a day |
| Gmail’s recommended time to fulfill unsubscribes | 48 hours |
| Yahoo time to honor unsubscribes | 2 days |
| Canada CASL time to honor an opt-out (address valid 60 days) | 10 business days |
| Australia Spam Act withdrawal of consent (address live 30 days) | 5 business days |
| Deadline the FTC proposed in 2005 and dropped (ten kept in 2008) | 3 business days |
Read on 26 October 2026 from 15 U.S.C. 7702 and 7704 on LII, 16 CFR 316 on eCFR, the FTC’s 2008 rule in the Federal Register, the FTC’s CAN-SPAM guide and press releases, Google’s email sender guidelines and FAQ, Yahoo’s Sender Hub, RFC 8058, Canada’s anti-spam law and the Spam Act 2003 on AustLII.
What CAN-SPAM requires of an unsubscribe
The Act, at 15 U.S.C. 7704(a)(3), requires every commercial email to carry a functioning return email address or other Internet-based mechanism, clearly and conspicuously displayed, that the recipient can use to ask for no more commercial email from that sender. It must also give clear and conspicuous notice that the option exists and a valid postal address, where a PO box or a registered private mailbox can count. A line such as “reply stop and I will not email you again” is a reply mechanism: a link is one way to comply, not the only one. The FTC says the law makes no exception for business-to-business email.
The details decide whether yours holds up. The route must keep working for at least 30 days after each email is sent, so if replies are your opt-out route, a sending domain you retire still has to receive them for 30 days after its last email. You then have 10 business days from receiving a request to stop. The clock runs from receipt, not from when someone reads the reply, and the FTC’s guide tells senders to make sure their spam filter does not block opt-out requests. The FTC proposed cutting the period to three business days in 2005 and kept ten in its 2008 rule, citing the burden on small businesses.
The request also covers the business, not the inbox. The Act defines the sender as the person who initiates the email and whose product it promotes, so an opt-out sent to one of 40 inboxes selling the same service has to stop all 40, and every domain behind them.
The FTC’s rule, 16 CFR 316.5, bans requiring a fee, any information beyond the email address and opt-out preferences, or any step other than a reply or a visit to a single web page, as a condition of opting out. No login, no second page. In 2008 the FTC also called a sales pitch before the opt-out completes “an unacceptable encumbrance.” Once someone opts out, you cannot sell, lease, exchange or transfer their address, except to a company you hire to help you comply. Bought lists carry rules of their own, covered in whether buying B2B email lists is legal.
Where one-click unsubscribe comes from
One-click is a mailbox provider rule. Google’s email sender guidelines require marketing and subscribed messages from senders of more than 5,000 messages a day to Gmail accounts to support one-click unsubscribe, through the List-Unsubscribe and List-Unsubscribe-Post headers, and to show a clearly visible unsubscribe link in the body. The one-click signal comes from RFC 8058, published in January 2017, which requires a DKIM signature covering both headers. Google’s FAQ says a mailto link in the body does not meet its one-click requirement and recommends fulfilling unsubscribe requests within 48 hours.
Two limits decide whether Google’s rule reaches you. A bulk sender is anyone who sends close to 5,000 messages or more to personal Gmail accounts in 24 hours, counted across the same primary domain, and the status is permanent once reached. And Google’s FAQ says the sender guidelines do not apply to messages sent to Google Workspace accounts. A B2B sequence to company addresses on Workspace sits outside Google’s rule and still inside CAN-SPAM.
Yahoo’s requirements for bulk senders ask for a list-unsubscribe header that supports one-click, recommend the RFC 8058 POST method, accept the mailto method and say to honor unsubscribes within 2 days.
CAN-SPAM requires a one-click unsubscribe link.
The Act asks for a reply address or an Internet-based mechanism. One-click is a Google and Yahoo rule.
A clear way out in every email, working for 30 days, honored within 10 business days.
No fee, no login and no more than a reply or one web page to opt out.
What getting it wrong has cost
The FTC can seek up to $53,088 for each email that breaks the law. In August 2023, Experian Consumer Services agreed to pay $650,000 to settle charges that it sent marketing emails to people who had signed up for accounts without offering a way to opt out. In August 2024, the security camera firm Verkada agreed to a $2.95 million penalty over commercial emails to prospective customers that, the complaint said, gave no option to unsubscribe, did not honor opt-out requests and carried no physical postal address. The FTC called it the largest penalty it had obtained for a CAN-SPAM violation.
Canada and Australia run their own clocks
Canada’s anti-spam law, in section 11, also allows 10 business days, counted from when the request is sent rather than received, and wants the opt-out address or web page valid for at least 60 days after each message. Australia’s Spam Act wants the unsubscribe address able to receive requests for at least 30 days after sending, and its Schedule 2 makes a withdrawal of consent take effect at the end of 5 business days. Gmail’s 48 hours, two days, is shorter than all three. Other countries are in our cold email laws by country table.
How I would set it up
I have delivered 500+ projects, and before a cold email program sends its first step, I would settle four things:
Write the way out into every step
Put one plain sentence in every email of the sequence that says how to opt out, by reply or on one web page, where a reader will see it.
Suppress by business, not by inbox
Route every opt-out, from any inbox or domain, into one suppression list that every sending account checks before each send. Read replies daily, because the 10 business days start when a request arrives.
Keep retired inboxes listening
When you rotate a domain out, keep its inboxes receiving and read for 30 days after the last email, or 60 if the list includes Canadians.
Add the one-click headers anyway
List-Unsubscribe and List-Unsubscribe-Post, signed by DKIM. They are required at bulk volume to personal Gmail and Yahoo addresses, and honoring every opt-out within 48 hours meets every clock above.
That is the opt-out layer of the email infrastructure we build: one-click unsubscribe headers and one suppression list across every inbox and domain. The FTC says both the company whose product is promoted and the company that sends can be held responsible, so if a cold email agency sends for you, keep the suppression list in your own accounts.
The bottom line
CAN-SPAM never asked for one click. It asks for a clear way out in every commercial email, live for 30 days and honored within 10 business days, with no fee, login or second page, and it binds the business, not the inbox. Gmail and Yahoo add one-click headers and a two-day clock for bulk senders, and Google’s rule does not reach Workspace inboxes at all. Honor every opt-out within two days across every inbox you own, and you meet both clocks. I am not a lawyer, and this is not legal advice.