6 ms·

Aren't you allowed to have your "click to unsubscribe" button lead to a page with a button that does a POST that actually unsubscribes? I feel like I've seen th

Aren't you allowed to have your "click to unsubscribe" button lead to a page with a button that does a POST that actually unsubscribes? I feel like I've seen that approach in use.

StavrosK 8y ago
What they do is load a page with a form redirect to do the POST, I believe, so link loaders won't follow it and you'll be safe.
criddell 8y ago
Don't make your users jump through hoops to unsubscribe. That seems like a typical dark pattern to me.
- mysterydip 8y ago
  Having a single confirmation step to prevent "oops" clicks doesn't seem like a dark pattern to me.
  - icebraining 8y ago
    Confirmation steps should only be used if the action can't be easily undone.
    - jimktrains2 8y ago
      And when a user receives an email saying they've been unsubscribed because an automated system prefetched the link, they won't be concerned or worried or confused at all. (Especially when this happens _every time_.
      - tedunangst 8y ago
        And then the automated system clicks the undo link... Problem solved!
        simcop2387 8y ago
        Which fires off a new email thanking them for re-subscribing. Soon your inbox is full.
    - bartread 8y ago
      It can't be easily undone if it was "clicked" by an automated process rather than a human being.
  - cjrp 8y ago
    The majority of people who clicked on the link did it on purpose, so a better pattern would be to make it unsubscribe immediately with a "didn't meant to unsubscribe? click here to undo" link afterwards.
    - corobo 8y ago
      The thread is talking about situations where an automated system would 'click' the link though. The automated system is probably not going to go "oh oops, resubbed" You could probably automate the POST action though. Equivalent of $('#unsub-button').click() on the unsubscribe page load
    - jimktrains2 8y ago
      You're making the mistake that this very article is highlighting: it's not just "people" who click links. An overzealous mail client or browser preloading links would force unsubscribe you without your knowledge or ability to undo. A single step, a button push, to confirm an unsubscription is fine.
      - criddell 8y ago
        > A single step, a button push, to confirm an unsubscription is fine. No, it really isn't. Lots of mailing lists operate exactly as the person you replied to mentioned where after unsubscribing you are given a chance to undo that action. That's a far more respectful way to operate.
        Can_Not 8y ago
        The user isn't going to see the "Oops! I need to undo" button when their email client helps themself behind the scenes.
        criddell 8y ago
        Yet somehow lots of places use the click-one-link-to-unsubscribe method and it seems to work. What are they doing differently? The follow up confirmation screen feels slimy to me like some kind of cable company retention tactic. That's why I called it a dark pattern.
  - elmigranto 8y ago
    Have a single "I clicked by mistake" button that resubscribes instead.
    - jimktrains2 8y ago
      Yes, the automated system prefetching links will always click said button.
      - icebraining 8y ago
        Not if the button issues a POST request.
        jimktrains2 8y ago
        The button I was responding about was an "undo unsubscribe". A bot won't click that button, but may follow a link.
        icebraining 8y ago
        Right, I assumed the button would be linked from a subsequent email confirming the unsubscription. You're right, a button in the unsubscription page doesn't help.
  - dumbfounder 8y ago
    You are right, it doesn't seem like one, but to pissed off users it doesn't matter. If you, for any reason, piss people off to the point where they complain to your registrar or your hosting provider it is bad news. Doesn't matter why. So, the answer is to make it as easy as possible to get removed, which is why people use GET. I have seen this with spam, and I have seen it with DMCA requests. My hosting provider will issue me a warning for any DMCA request that they will shut me down within 48 hours if I don't comply. Even when it is clearly not a valid request. Even when the content has already been removed. They don't even check, they just say "do it or else". And I pay them thousands per month. Godaddy is the same way, I have had people complain to them, and then they threaten to shut down the domain. When you have been threatened repeatedly to be shut down for operating normally you don't take any chances. It isn't worth it.
- always_good 8y ago
  Github also does it for their logout button for good reason. Is that a dark evil pattern to keep you logged in to their ecosystem? Or just something someone would say who doesn't understand it?
  - criddell 8y ago
    I trust Github. If it were up to me, I'd remove the logout confirmation from Github but having it there doesn't particularly bother me. When Facebook does it, I do have a problem with it because I don't think their motives are as pure.
drdeca 8y ago
How about just having, near the unsubscribe link in the email, a link that says "click here to ignore up to one unsubscribe link press within two minutes of clicking this link", so that the automated process that clicked the unsubscribe link by mistake will also click that link. The page in question could also have a "actually, I do want to unsubscribe, I just clicked the wrong link by accident" button as well, in case a human reader is confused. --- Or, one link that says "unsubscribe immediately" and another that says "unsubscribe only after confirmation", and the first one unsubscribes immediately, unless they also click the second link immediately before or after, while the second link only unsubscribes them if they click a confirm button on the page? --- Or, maybe the unsubscribe link could have a confirmation button, but would also have some javascript to confirm the unsubscribe after a few moments of the page being fully loaded (the button being used if they have javascript disabled, for example)

Aren't you allowed to have your "click to unsubscribe" button lead to a page with a button that does a POST that actually unsubscribes? I feel like I've seen that approach in use.

StavrosK 8y ago

What they do is load a page with a form redirect to do the POST, I believe, so link loaders won't follow it and you'll be safe.

criddell 8y ago

Don't make your users jump through hoops to unsubscribe. That seems like a typical dark pattern to me.

mysterydip 8y ago
Having a single confirmation step to prevent "oops" clicks doesn't seem like a dark pattern to me.
- icebraining 8y ago
  Confirmation steps should only be used if the action can't be easily undone.
  - jimktrains2 8y ago
    And when a user receives an email saying they've been unsubscribed because an automated system prefetched the link, they won't be concerned or worried or confused at all. (Especially when this happens _every time_.
    - tedunangst 8y ago
      And then the automated system clicks the undo link... Problem solved!
      - simcop2387 8y ago
        Which fires off a new email thanking them for re-subscribing. Soon your inbox is full.
  - bartread 8y ago
    It can't be easily undone if it was "clicked" by an automated process rather than a human being.
- cjrp 8y ago
  The majority of people who clicked on the link did it on purpose, so a better pattern would be to make it unsubscribe immediately with a "didn't meant to unsubscribe? click here to undo" link afterwards.
  - corobo 8y ago
    The thread is talking about situations where an automated system would 'click' the link though. The automated system is probably not going to go "oh oops, resubbed" You could probably automate the POST action though. Equivalent of $('#unsub-button').click() on the unsubscribe page load
  - jimktrains2 8y ago
    You're making the mistake that this very article is highlighting: it's not just "people" who click links. An overzealous mail client or browser preloading links would force unsubscribe you without your knowledge or ability to undo. A single step, a button push, to confirm an unsubscription is fine.
    - criddell 8y ago
      > A single step, a button push, to confirm an unsubscription is fine. No, it really isn't. Lots of mailing lists operate exactly as the person you replied to mentioned where after unsubscribing you are given a chance to undo that action. That's a far more respectful way to operate.
      - Can_Not 8y ago
        The user isn't going to see the "Oops! I need to undo" button when their email client helps themself behind the scenes.
        criddell 8y ago
        Yet somehow lots of places use the click-one-link-to-unsubscribe method and it seems to work. What are they doing differently? The follow up confirmation screen feels slimy to me like some kind of cable company retention tactic. That's why I called it a dark pattern.
- elmigranto 8y ago
  Have a single "I clicked by mistake" button that resubscribes instead.
  - jimktrains2 8y ago
    Yes, the automated system prefetching links will always click said button.
    - icebraining 8y ago
      Not if the button issues a POST request.
      - jimktrains2 8y ago
        The button I was responding about was an "undo unsubscribe". A bot won't click that button, but may follow a link.
        icebraining 8y ago
        Right, I assumed the button would be linked from a subsequent email confirming the unsubscription. You're right, a button in the unsubscription page doesn't help.
- dumbfounder 8y ago
  You are right, it doesn't seem like one, but to pissed off users it doesn't matter. If you, for any reason, piss people off to the point where they complain to your registrar or your hosting provider it is bad news. Doesn't matter why. So, the answer is to make it as easy as possible to get removed, which is why people use GET. I have seen this with spam, and I have seen it with DMCA requests. My hosting provider will issue me a warning for any DMCA request that they will shut me down within 48 hours if I don't comply. Even when it is clearly not a valid request. Even when the content has already been removed. They don't even check, they just say "do it or else". And I pay them thousands per month. Godaddy is the same way, I have had people complain to them, and then they threaten to shut down the domain. When you have been threatened repeatedly to be shut down for operating normally you don't take any chances. It isn't worth it.
always_good 8y ago
Github also does it for their logout button for good reason. Is that a dark evil pattern to keep you logged in to their ecosystem? Or just something someone would say who doesn't understand it?
- criddell 8y ago
  I trust Github. If it were up to me, I'd remove the logout confirmation from Github but having it there doesn't particularly bother me. When Facebook does it, I do have a problem with it because I don't think their motives are as pure.

drdeca 8y ago

How about just having, near the unsubscribe link in the email, a link that says "click here to ignore up to one unsubscribe link press within two minutes of clicking this link", so that the automated process that clicked the unsubscribe link by mistake will also click that link. The page in question could also have a "actually, I do want to unsubscribe, I just clicked the wrong link by accident" button as well, in case a human reader is confused. --- Or, one link that says "unsubscribe immediately" and another that says "unsubscribe only after confirmation", and the first one unsubscribes immediately, unless they also click the second link immediately before or after, while the second link only unsubscribes them if they click a confirm button on the page? --- Or, maybe the unsubscribe link could have a confirmation button, but would also have some javascript to confirm the unsubscribe after a few moments of the page being fully loaded (the button being used if they have javascript disabled, for example)