An email suppression list is the record of people who told you to stop, kept so that no later import or bought list puts them back into a sequence. My suggestion, based mainly on UK regulator guidance and a French regulator recommendation: do not delete it. The UK regulator’s right to object guidance (page last updated 2 November 2026) says: “You should not delete a person's information from a suppression list.” In the US, once someone opts out through your opt-out mechanism, CAN-SPAM bars you from selling or transferring their address except to comply with the law.
My view: the riskiest opt-out is the one someone deleted. A tool’s re-entry block, where it has one, covers that tool only, so the next bought or scraped list can bring the address straight back.
In my view, deleting an opt-out can remove the one record that would have stopped the next send.
Key numbers
| Item | Number |
|---|---|
| CAN-SPAM deadline to stop commercial email after an opt-out (15 U.S.C. 7704(a)(4)(A)(i), for requests made through your opt-out mechanism) | 10 business days |
| Maximum CAN-SPAM penalty per violating email (per the FTC compliance guide) | $53,088 |
| End date for the CAN-SPAM opt-out prohibitions (only exit named: affirmative consent after the request, 7704(a)(4)(B)) | None stated (my reading) |
| GDPR deadline to tell the person what action you took (without undue delay; extendable by two further months where necessary, Article 12(3)) | Within one month |
| UK ICO right to object guidance last updated (page date; the ICO does not say whether the suppression wording changed) | 2 November 2026 |
| CNIL recommended minimum to keep objection data (CNIL Q&A dated 28 January 2022) | 3 years |
| Routes back in after a HubSpot permanent delete (a form, an email to a team inbox, an API request) | 3 |
| Mailchimp window to delete after a GDPR removal notice (from every audience and connected integration) | 30 days |
| Reasons for the Amazon SES account-level suppression list | BOUNCE, COMPLAINT |
| SES deletes the addresses on the list if sending is paused (account-level list; otherwise entries remain until you remove them) | After 90 days |
Read on 6 November 2026 from the FTC CAN-SPAM guide, 15 U.S.C. 7704, the GDPR on EUR-Lex, ICO and CNIL guidance, and HubSpot, Mailchimp and Amazon SES documentation.
What the law and regulators say about keeping opt-outs
In the US, 15 U.S.C. 7704(a)(4) makes it unlawful to send commercial email within the scope of an opt-out more than 10 business days after the request arrives through your opt-out mechanism. It also bars the sender, “or any other person who knows that the recipient has made such a request”, from selling, leasing, exchanging or otherwise transferring the address “for any purpose other than compliance with this chapter or other provision of law.” On my reading, the text gives these prohibitions no end date, and the only exit it names is affirmative consent after the request. The FTC puts the penalty at up to $53,088 for each separate email in violation.
Under the EU GDPR, Article 21(2) gives a person the right to object “at any time” to processing of their personal data for direct marketing, and Article 21(3) says that once they do, “the personal data shall no longer be processed for such purposes.” An objection under 21(2) is also a ground for erasure in Article 17(1)(c). The regulation’s text never uses the words suppression list.
In the UK, where the ICO applies the UK GDPR and PECR rather than the EU regulation, the guidance is explicit. The ICO says people have “an absolute right to stop you using their information for direct marketing”, and that an objection “does not automatically mean that you need to erase” their information: “in most cases, it is preferable to suppress their details.” Suppression, in its words, means keeping “just enough personal information” to respect the preference in future. The page was last updated on 2 November 2026 for “DUAA amendments” (on my reading, the Data (Use and Access) Act 2025) and “style guide”; the ICO does not say whether the suppression wording changed.
In France, the CNIL’s Q&A on its commercial management framework, dated 28 January 2022, says a “liste repoussoir” lets you durably exclude people who objected from new prospecting. It recommends keeping the information needed to honor an objection for at least 3 years, and says that data may not be used for anything else and only what is needed must be kept. The 3-year figure is a recommendation, not a statute.
| Source | What it says about an opt-out |
|---|---|
| CAN-SPAM 7704(a)(4), US | Stop commercial email within the opt-out’s scope within 10 business days of a request through your mechanism; no sale or transfer except to comply; no end date in the text, on my reading |
| GDPR Articles 21(3), 17(1)(c), EU | No more direct marketing use; the objection is an erasure ground |
| ICO, page last updated 2 November 2026, UK | Suppression preferable to erasure in most cases; you should not delete from the list |
| CNIL Q&A, 28 January 2022, France | Recommends keeping objection data at least 3 years; for that use only |
This is general information, not legal advice.
When someone asks you to delete everything
The hard case is a person who objects and also asks for erasure. The ICO’s direct marketing guidance gives a UK example: the company “deletes all of it, apart from a small amount that it keeps on its suppression list”, and is complying. Its reason: “Because we don’t consider that a suppression list is used for direct marketing purposes, there is no automatic right for people to have their information on such a list deleted.” That is the UK position; I have not checked EU-level (EDPB) guidance. Under the EU GDPR, Article 12(3) says you must tell the person what action you took without undue delay and in any event within one month, extendable by two further months where necessary, and Article 19 says to tell each recipient you disclosed the data to, unless that proves impossible or involves disproportionate effort.
Delete the contact everywhere when they say stop.
In my view, the next bought or scraped list can bring the address back, and a tool’s re-entry block covers that tool only.
My suggestion: keep the address, the date, the source and the scope on a suppression list, and delete what you no longer need.
The ICO says suppression means keeping just enough personal information to respect the preference.
What your tools do when you press delete
Some tools build a re-entry block into the delete button. HubSpot’s help page on permanent deletion, last updated 15 October 2026, says that afterwards “you will not be able to add their email (primary or additional) to your HubSpot account or its sandboxes through the HubSpot UI or an import.” HubSpot says this is supported by anonymized data. Three routes stay open: a form on your website, an email to an inbox connected as a team email, or an API request.
Mailchimp says to delete contacts “for General Data Protection Regulation (GDPR) purposes only.” A deleted contact can come back only by rejoining through the hosted Mailchimp form, and its help page tells you to choose “I understand these contacts can never be re-imported again” before typing PERMANENTLY DELETE. If a contact asks for their information to be removed for GDPR purposes, Mailchimp emails you, and you then have 30 days to delete them from every audience and connected integration.
A sending service’s suppression list is, in my view, a different list. Amazon SES gives two reasons for its account-level suppression list, BOUNCE and COMPLAINT, and lets you add or remove addresses individually or in bulk; addresses “remain there until you remove them”, or are deleted after 90 days if your account’s sending is paused.
Build the list in four moves
Keep four fields and nothing else
My suggestion: the address, the date, where the request came from and its scope, such as all marketing or one brand. The ICO says you must not keep more than you need; the CNIL says only what is needed to honor the objection must be kept.
One list for the business, checked before every import
My suggestion: route opt-outs from every inbox and domain into it, and check every bought, scraped or exported list against it before the list reaches a sending tool. CAN-SPAM counts 10 business days from when a request arrives through your opt-out mechanism.
Keep it apart from your bounce list
My view: Amazon SES’s account-level list, fed by bounces and complaints, is one you can add to and remove from; keep opt-outs on a separate list you do not prune. The ICO says you should not delete from a suppression list.
Use the delete that blocks re-entry
My suggestion, based on the UK ICO’s example: for an erasure request, use the tool’s permanent delete and keep the suppression entry; I have not checked EU-level (EDPB) guidance. On my reading of Article 19, tell the agencies and tools you shared the data with, unless that proves impossible or involves disproportionate effort. Test the routes back in that the tool lists, such as HubSpot’s API request.
My team’s record: 500+ projects delivered across 30 countries. Our email infrastructure page covers one-click unsubscribe, suppression and list validation; what you keep, and for how long, is for you and your lawyer to decide. For the opt-out deadline, see CAN-SPAM’s 10-business-day rule; for bought lists, see whether buying B2B email lists is legal; to price inboxes, see email hosting cost.
The bottom line
In my view, treat an opt-out as a record you keep, not a row you delete: keep the minimum, check every new list against it, share it only to comply, and keep it apart from bounces.