What are the CAN-SPAM and CASL requirements for unsubscribe confirmation pages, preference updates, and email re-entry?
Michael Ko
Co-founder & CEO, Suped
Published 13 Jul 2025
Updated 16 Aug 2025
7 min read
Navigating the complexities of email marketing compliance is a critical aspect of ensuring your messages reach the inbox and maintain a positive sender reputation. Two of the most significant pieces of legislation governing commercial email are the CAN-SPAM Act in the United States and Canada’s Anti-Spam Legislation (CASL). These laws dictate not only how you obtain consent and identify your messages, but also, crucially, how you handle unsubscribe requests.
Beyond simply providing an unsubscribe link, there are specific requirements concerning what happens after a recipient clicks that link. This includes the nature of unsubscribe confirmation pages, the options for updating email preferences, and the rules around re-entry into your mailing lists. Understanding these nuances is essential to avoid hefty fines and preserve your sender reputation.
The goal is to make the unsubscribe process as straightforward and user-friendly as possible, minimizing frustration and preventing recipients from marking your emails as spam. This approach not only ensures legal compliance but also fosters trust with your audience, even if they choose to opt out.
CAN-SPAM act: unsubscribe requirements
The CAN-SPAM Act sets the baseline for commercial email in the U.S., focusing heavily on the unsubscribe mechanism. One of its core tenets is that every commercial email must include a clear and conspicuous way for recipients to opt out of receiving future emails from you. This means a functional unsubscribe link or a clear return email address that recipients can use to send an opt-out request.
Once an unsubscribe request is made, you must honor it within 10 business days. It’s important to note that you cannot charge a fee for opting out, require any personal identifying information beyond an email address (if using a static unsubscribe page), or make the recipient take any steps other than sending a reply email or visiting a single page on an Internet website to opt out. The opt-out mechanism must remain active for at least 30 days after the email is sent.
While CAN-SPAM allows for a two-click unsubscribe (one click in the email, one click to confirm on a web page), recent changes from major mailbox providers like Google and Yahoo increasingly favor a one-click unsubscribe experience using the List-Unsubscribe header. This is becoming a de facto standard for good deliverability, even if not explicitly mandated by CAN-SPAM itself. You can find more details on the specific requirements from the FTC's CAN-SPAM compliance guide.
CASL: Canada's anti-spam legislation
Canada's Anti-Spam Legislation (CASL) is often considered one of the strictest anti-spam laws globally, primarily due to its emphasis on explicit consent. Unlike CAN-SPAM's opt-out model, CASL generally requires you to obtain express consent before sending commercial electronic messages (CEMs). This proactive consent means recipients must actively agree to receive your emails, rather than simply having the option to unsubscribe.
Even with consent, every commercial electronic message sent under CASL must include specific identifying information and a functional unsubscribe mechanism. This includes clear identification of the sender (including their contact information), and a clear opportunity for recipients to withdraw their consent. Similar to CAN-SPAM, unsubscribe requests must be processed within 10 business days.
CASL is particularly stringent about the clarity and accessibility of the unsubscribe link. It should be easily discoverable and understandable, without requiring excessive effort or navigating multiple pages. You can review the CRTC's FAQs on CASL for more detailed guidance on compliance, particularly regarding consent and unsubscribe provisions. Violations of CASL can lead to substantial penalties, making strict adherence crucial for any organization sending emails to Canadian recipients.
Unsubscribe confirmation pages and preference centers
When a recipient clicks an unsubscribe link, they are typically directed to an unsubscribe confirmation page or a preference center. The primary purpose of this page is to facilitate the opt-out process. While you might be tempted to offer alternatives, the law mandates that the primary function should be to allow the user to easily and quickly stop receiving all commercial messages.
It is permissible to offer options on this page, such as allowing subscribers to update their preferences (e.g., change from daily to weekly emails, or select specific content categories) or to provide a reason for unsubscribing. However, these options must be entirely optional and should not impede the immediate and clear ability to fully unsubscribe. The full opt-out button must be prominently displayed and easy to find, ideally at the top of the page.
A crucial point of compliance, particularly under CAN-SPAM, is that you cannot require the recipient to re-enter their email address if the unsubscribe link already uniquely identifies them. Most modern email marketing platforms embed a unique identifier (like a hashed token) in the unsubscribe link, which negates the need for re-entry. Requiring re-entry adds unnecessary friction, can lead to typos, and often increases spam complaints, ultimately harming your deliverability.
Good practices
Clear opt-out: Provide an obvious, single button to stop all emails.
Optional choices: Offer frequency reduction or specific content preferences as optional alternatives.
Instant processing: Process unsubscribe requests immediately, even if laws allow longer.
Privacy-centric: Avoid requiring personal information beyond initial consent.
Re-entering email: Don't ask for the email if the link already identifies them.
Hidden opt-out: Avoid burying the full unsubscribe option.
Mandatory fields: Do not require reasons for unsubscribing.
Email re-entry and re-subscription
While laws focus on the ability to opt out, they also implicitly address the concept of email re-entry. Once a recipient has unsubscribed, you are legally prohibited from sending them any further commercial emails unless they explicitly opt back in. This isn't just a best practice, it's a critical compliance requirement. Sending emails to someone who has unsubscribed can lead to direct violations, hefty fines, and severe damage to your sender reputation, potentially leading to your IP or domain being added to a blacklist (or blocklist).
If a user wishes to re-enter your mailing list after unsubscribing, they must initiate this action themselves. This usually involves them actively re-subscribing through a sign-up form on your website. Automated re-subscriptions, or adding someone back to a list without their explicit, renewed consent, are clear violations of both CAN-SPAM and CASL, and can also trigger spam traps, further impacting your deliverability. Always ensure you have clear, verifiable consent for all email recipients.
Views from the trenches
Best practices
Ensure the full unsubscribe option is always the most prominent and easily accessible choice on any preference page.
Utilize unique, hashed tokens in unsubscribe links to prevent requiring email re-entry and enhance security.
Implement immediate processing for unsubscribe requests, even though legal frameworks allow a longer timeframe.
Common pitfalls
Requiring users to log in or provide additional personal information to complete an unsubscribe request.
Burying the complete opt-out option within a complex preference center with many distractions.
Failing to process unsubscribe requests within the mandated 10 business days, leading to continued unwanted emails.
Expert tips
Displaying the email address being unsubscribed can be helpful, but only if using identity tokens that are secure.
Ensure your unsubscribe logic correctly handles email addresses with the '+' tag (sub-addressing).
A smooth unsubscribe process is crucial for preventing spam complaints and maintaining a good sender reputation.
Expert view
Expert from Email Geeks says that legislation typically allows requiring an email address for old static mailing lists, but it is not a recommended practice. If an authenticated token is used, re-entering the email is unnecessary and indicates incompetence or an intentional friction point. Displaying the email address is acceptable if secure identity tokens are used.
2023-01-27 - Email Geeks
Expert view
Expert from Email Geeks says that offering an opt-down option (e.g., reduce frequency) is fine as long as a clear 'stop all email' option is present. Asking for an optional reason for unsubscribing is also acceptable, but requiring it is not. No action beyond visiting a webpage, entering an email, and clicking a single button should be required for an unsubscribe.
2023-01-27 - Email Geeks
Prioritizing a seamless unsubscribe experience
Adhering to CAN-SPAM and CASL requirements for unsubscribe pages, preference updates, and re-entry is not just a matter of legal compliance, but a foundational element of good email deliverability. A convoluted or frustrating unsubscribe process can quickly lead to increased spam complaints, a damaged sender reputation, and ultimately, emails landing in the spam folder or being blocked by mailbox providers.
Prioritizing a transparent and simple opt-out experience builds trust with your audience, even those who choose to leave your list. By respecting their choices and making it easy to manage their communication preferences, you safeguard your domain's reputation and ensure that your legitimate messages continue to reach engaged subscribers.
Regularly reviewing your unsubscribe flow against current legal standards and best practices, such as Gmail and Yahoo's new requirements, will help you maintain optimal email deliverability and avoid potential blocklisting (or blacklisting) issues.
