How long should you honor opt-outs after migrating ESPs?
Updated on 1 Nov 2026: We clarified opt-out timing after ESP migrations, including Gmail and Yahoo deadlines and the handling of old one-click unsubscribe links.
Honor migrated opt-outs until the person gives fresh, documented consent for the relevant marketing. Keep the old ESP unsubscribe path live for at least 30 days after the final commercial send covered by US or Australian law, or 60 days if CASL applies. A 90-day overlap is a practical planning buffer.
The overlap window governs how long old unsubscribe mechanisms need to keep accepting requests. If someone unsubscribed before the move, that address stays suppressed in the new ESP within the original opt-out scope unless the person gives fresh, documented consent later. Historical reporting access is useful for reconciliation but does not replace functioning unsubscribe routes.
- Until fresh consent: Honor migrated opt-outs within their recorded scope; migration does not reset them.
- 30 calendar days: Keep US and Australian unsubscribe mechanisms working after each message is sent.
- 60 calendar days: Keep CASL unsubscribe addresses or web pages valid after each message is sent.
- 10 business days: The CAN-SPAM processing limit; CASL requires action without delay and no later than this limit.
- 5 working days: Honor Australian unsubscribe requests within this limit.
- 90 days: Use this as a practical overlap window when the old unsubscribe routes can stay available.
Unsubscribe deadlines and ESP overlap windows
For a US commercial email, CAN-SPAM requires the opt-out mechanism to process requests for at least 30 calendar days after the message is sent, and the request has to be honored within 10 business days after receipt. For commercial electronic messages covered by CASL, the unsubscribe address or web page must stay valid for at least 60 calendar days, and the request has to be acted on without delay and no later than 10 business days after receipt. Australia's Spam Act requires the unsubscribe option to work for at least 30 calendar days and the request to be honored within five working days.
|
|
|
|
|---|---|---|---|
CAN-SPAM | At least 30 calendar days | 10 business days | Keep old links live |
CASL | At least 60 calendar days | Without delay; at most 10 business days | Use a longer overlap |
Spam Act 2003 (Australia) | At least 30 calendar days | 5 working days | Sync before the next send |
GDPR, direct marketing objections | No fixed period in GDPR | Stop direct marketing on objection | Retain a suppression record |
Example overlap policy | 90 days | Before the next send | Audit before shutdown |
The 90-day row is an operational example. Apply the strictest relevant legal and mailbox provider deadlines.
Count the overlap after the final commercial message sent through the old ESP, including automated campaigns. Closing the account or importing contacts does not start that clock. Six weeks gives US-only or Australian programs an operational buffer, but it does not cover the CASL minimum. For programs subject to CASL, 90 days covers the 60-day link-validity period and leaves time for late opens and final reconciliation. Longer windows are operational choices.
Overlap window planning examples
Illustrative windows after the final old ESP commercial message, including automated sends.
US and Australia
30 days
Minimum mechanism availability where only these timing rules apply.
Operational buffer
45-60 days
Extra time for US or Australian programs; CASL requires at least 60 days.
Practical overlap
90 days
An optional buffer beyond the CASL minimum.
Longer overlap
180 days
Useful for long buying cycles or low-cadence newsletters.
Meet Gmail and Yahoo unsubscribe deadlines
Gmail's subscription guidelines say to process unsubscribe requests within 48 hours. Yahoo's bulk sender requirements set a two-day deadline. These mailbox provider expectations are separate from the legal limits above. Sync before the next marketing send and meet whichever applicable deadline is sooner.
For marketing and subscription email subject to Gmail's bulk sender rules, implement RFC 8058 one-click unsubscribe alongside the footer link. The new ESP needs an HTTPS URL in List-Unsubscribe and the header List-Unsubscribe-Post: List-Unsubscribe=One-Click, with both headers covered by a valid DKIM signature.
Keep old one-click endpoints working
An RFC 8058 endpoint must process the HTTPS POST without redirecting or asking the subscriber to complete another step. Test an actual request using a controlled test address against an old campaign URL, and confirm that it suppresses the intended address within the correct list scope in the new ESP.
Preserve suppression lists and opt-out scope
The old platform can be retired once old unsubscribe mechanisms are covered. An opt-out remains a marketing restriction within its recorded scope until the person gives fresh, documented consent. Import suppression lists before active subscribers so a contact import cannot silently reactivate an unsubscribed address.
An ESP migration does not make opt-outs expire. A person can re-subscribe through a clear opt-in path, but a system migration does not reset their earlier choice.
Do not migrate only the active list
A common migration mistake is exporting subscribers and leaving behind suppression lists. Import the opt-out state before the first commercial campaign.
- Global unsubscribes: Move users who opted out of all marketing.
- List opt-outs: Preserve newsletter, product, region, and brand-level preferences.
- Complaints: Suppress spam complaints even when they are not labeled as unsubscribes.
- Source notes: Keep timestamps, old ESP source, consent scope, and import batch IDs.
If you maintain regional programs, check the country timeframes before setting the shutdown date. Your internal policy should meet the strictest rule that applies to the audience, not the easiest rule in your home market.
A practical old ESP shutdown plan
Stop sending through the old ESP, keep its unsubscribe mechanisms live long enough to catch late requests, and sync new opt-outs into the new ESP until the overlap window ends. Confirm with the vendor that an inactive or reduced account still processes unsubscribes before changing the contract.
Migration runbooktext
1. Stop old campaigns and disable marketing automations; record the final send time. 2. Export unsubscribes, complaints, hard bounces, and scoped preferences. 3. Import global suppressions and preserve list-level opt-out scope before sending. 4. Keep old footer and one-click endpoints working for the applicable overlap window. 5. Sync each new opt-out to every active suppression store before the next send. 6. Meet the earliest applicable processing deadline, including mailbox provider requirements. 7. Reconcile individual suppression records and finish processing requests received before shutdown. 8. Archive the necessary suppression export and shutdown notes after the window closes.
The sync cadence should be faster than the legal deadline. A person who unsubscribes on Monday should not receive more campaigns while an export waits for its scheduled run. Sync before each send, or use near-real-time updates when both ESPs are sending. A daily sync remains workable for a low-cadence program if someone owns the task and no campaign can run against stale suppression data.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
Before the first campaign in the new ESP, send a live test message and inspect its headers with Suped's email tester. Then use a test address to exercise the footer link and one-click endpoint, and confirm suppression in the new ESP. Also check the branded click domain and redirect chain for footer links.
For a broader pre-send review, run a Suped domain health check on the sending domain before the migration cutover. It catches DNS and authentication issues that can look like engagement problems after the switch.
Prevent opt-out gaps during parallel sending
If the old and new ESPs both send during a phased cutover, a one-way export is not enough. An unsubscribe captured by either platform has to reach the other platform before its next marketing send. Otherwise, each ESP can hold a different answer for the same address.
- Choose a source of truth: Use one suppression store to decide whether any marketing send is allowed.
- Update both directions: Send old-ESP and new-ESP opt-outs into that store, then return the suppression to both platforms.
- Check before sending: Reconcile individual addresses and opt-out scope before either platform releases a campaign.
- Assign one owner: Give a named operator responsibility for failed syncs and the final parity check.
A webhook or API update gives the shortest gap, but a scheduled file process can work when campaign cadence is low. Reconnect CRM integrations and preference centers to the same suppression store, and prevent an old subscribed flag from overwriting an opt-out without recorded fresh consent. Keep bidirectional updates during parallel sends, then continue forwarding late opt-outs from the old routes until their overlap window ends.
How to handle old unsubscribe URLs
Old emails keep living in inboxes. People search, forward, archive, and open them weeks later. If the old unsubscribe URL breaks, the person experiences it as a brand problem, not as a vendor migration problem.
Gmail email showing header and footer unsubscribe links that need to work after an ESP migration.
The easiest option is to leave the old ESP account and branded click domain active through the overlap window. If you control the original hostname and URL paths, a replacement handler can capture requests in the new ESP. A page at a different address does not repair links already sent. For a vendor-owned hostname, arrange continued processing with the vendor before canceling.
Simple overlap
- Best fit: Most migrations with stable branded links.
- How it works: Leave the old ESP live and export opt-outs.
- Main risk: Someone forgets the scheduled export.
- Control: Assign an owner and audit the final sync.
Fallback routing
- Best fit: Custom links on a hostname your business controls.
- How it works: The original footer URL opens a single unsubscribe page.
- Main risk: The old token cannot identify the subscriber.
- Control: Accept the email address on that page and record the opt-out.
For footer links, preserve the original token where possible. If it cannot identify the subscriber, offer a single page that asks only for the email address, without a fee or account login. Use the following form copy only for footer links opened by a person. Automated one-click requests still need a working POST endpoint.
Fallback footer unsubscribe page copytext
You opened an email sent before our platform migration. To stop marketing email, enter your email address below and select Unsubscribe. Email address: [email field] [Unsubscribe] If you already unsubscribed, no further action is needed.
What to test before the first new ESP send
Opt-out handling is only one part of an ESP migration. A migration can change DKIM signatures and bounce processing as well as sending IPs or pools. Check branded link domains and unsubscribe headers alongside the suppression import, so authentication failures are diagnosed separately from consent failures.
ESP migration flowchart showing suppression imports and continued processing of old unsubscribe links.
During a migration, Suped's DMARC monitoring can track authentication across old and new sending sources. Use Suped's reports and alerts to spot an unexpected sender or a DMARC failure in the new sending setup, then check blocklist monitoring separately for a blocklist (blacklist) change. That keeps authentication and blacklist findings separate from consent-handling failures.
Suped DMARC dashboard showing email volume, authentication health, and source breakdown
Check sender reputation separately from suppression migration. If unsubscribed users accidentally receive mail, that can drive complaints. Authentication failures can prevent delivery to legitimate subscribers. Both problems can appear at the same time after a platform switch.
What suppression data to retain
Retain the minimum data needed to honor the opt-out, prove why the address is suppressed, and prevent accidental reactivation. That usually means the email address or an identifier that reliably matches future imports, opt-out scope, timestamp, source system, and import reference. Keep this limited record for as long as suppression is necessary, review the documented retention policy, and remove unnecessary profile history.
Keep a minimal suppression archive
A suppression file should have enough information to stop marketing sends and answer internal audit questions. It should not become a backdoor marketing database.
- Keep: Address, scope, timestamp, source, and batch reference.
- Remove: Unneeded profile fields, segments, scores, and behavioral history.
- Protect: Limit access to people who manage compliance and email operations.
- Review: Document the policy with legal, privacy, and data teams.
After the overlap window closes, archive only the suppression export and records needed to show the final sync time and shutdown decision, with reconciliation results. Resolve requests received on the final day before stopping the processing job. Keep a support route available for later opt-outs and apply them across active marketing systems.
Frequently asked questions
No. Treat migrated opt-outs as continuing suppressions. A person can re-subscribe through a fresh opt-in flow, but changing ESPs does not erase the earlier unsubscribe.
Keep the old ESP open unless a tested replacement or vendor arrangement continues processing the original unsubscribe URLs. Keep those mechanisms working for at least the applicable minimum: 30 calendar days in the US and Australia, or 60 under CASL, after the final commercial send. A 90-day overlap gives an operational buffer.
Sync before the next marketing send and meet the earliest applicable deadline. Gmail's subscription guidance specifies 48 hours; Yahoo's bulk sender rules specify two days. Use one suppression source of truth while both ESPs send.
For a human-clicked footer URL on a hostname you control, use a single page that asks only for the email address and records the opt-out. Automated one-click requests require a working endpoint that resolves the original token without asking the person for more information.
Keep necessary transactional messages separate from marketing and apply the rules for their actual content. A receipt or password reset does not restore marketing consent, and adding promotions changes how the message is assessed.
