3 ms·

I thought it was part of CAN SPAM that you can’t require a second action and that was why the big email sending providers moved to that.

KeepFlying 3y ago
Probably true but how do you handle autodetonation of email links in that case? Too many emails servers will click links automatically to check for issues. That was my understanding at least.
- justinator 3y ago
  Unsubscribe link goes to a page that has a form that's automatically submitted via JavaScript. Disable that for the first 5 minutes of that link's life to get around automated things.
EvanAnderson 3y ago
So many email security systems preemptively access every URL in messages. I found that I receive a GET for virtually every unsubscribe URL I send out. I don't read clicking a "confirm" button as a second action. The attorney didn't either. He also said CAN SPAN doesn't apply to a 501(c)3. I still try to comply to be a good citizen.
jabroni_salad 3y ago
You can require a second action such as clicking a button. What you can't do is take them to a page that says "to unsubscribe, send a certified letter to our headquarters and wait 90 business days". The entire transaction must be completed at the page you link to.
- hnick 3y ago
  Or, as I so often get, ask me to log in to "my account". Which is not my account, it's someone else's account but they don't know their own email address, so logging in is probably technically unauthorised access to computer systems and highly illegal. Bonus points when contacting support requires me to log in to "my account" too.
jcrawfordor 3y ago
It's not really common for clicking a link to immediately unsubscribe, almost everyone requires you to click a button after navigating to the unsubscribe link. Otherwise you have issues with link scanners unsubscribing your recipients without their knowledge. There are some more complex ways to approach this with JavaScript checks for "real browser" but IMO these are more likely to create frustrating friction to unsubscribing (by not working if the user has an adblocker for example) than having the user click a button. I've seen this pattern of unsubscribe link, then click button approved as CAN-SPAM compliant more than once so I don't think there's a legal concern. The CAN-SPAM rule seems more targeted at the systems you used to see a lot that required the user to log into their account, type in their email address, or figure out a complicated "communications preferences" list to use the unsubscribe form. check out https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-316/section-316.5 https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C... It's a little fuzzy to me how exactly to interpret this but I think you could reasonably read it as allowing even unsubscribe pages that require you to type your email address in again (even though I detest these and don't think the problem they're intended to solve is a meaningful one).
- pests 3y ago
  > unsubscribe pages that require you to type your email address in again These are fine for me if the email is prepopulated.
bruckie 3y ago
Google requires senders to use the `List-Unsubscribe-Post` and `List-Unsubscribe` headers, which use a POST request to avoid this problem. Details: https://support.google.com/mail/answer/81126#zippy=%2Crequirements-for-sending-or-more-messages-per-day https://support.google.com/mail/answer/81126#zippy=%2Crequir... (I work for Google, but on something totally unrelated, and don't speak for them or have any inside knowledge. I was just curious and looked it up.)

KeepFlying 3y ago

Probably true but how do you handle autodetonation of email links in that case? Too many emails servers will click links automatically to check for issues. That was my understanding at least.

justinator 3y ago
Unsubscribe link goes to a page that has a form that's automatically submitted via JavaScript. Disable that for the first 5 minutes of that link's life to get around automated things.

EvanAnderson 3y ago

So many email security systems preemptively access every URL in messages. I found that I receive a GET for virtually every unsubscribe URL I send out. I don't read clicking a "confirm" button as a second action. The attorney didn't either. He also said CAN SPAN doesn't apply to a 501(c)3. I still try to comply to be a good citizen.

jabroni_salad 3y ago

You can require a second action such as clicking a button. What you can't do is take them to a page that says "to unsubscribe, send a certified letter to our headquarters and wait 90 business days". The entire transaction must be completed at the page you link to.

hnick 3y ago
Or, as I so often get, ask me to log in to "my account". Which is not my account, it's someone else's account but they don't know their own email address, so logging in is probably technically unauthorised access to computer systems and highly illegal. Bonus points when contacting support requires me to log in to "my account" too.

jcrawfordor 3y ago

It's not really common for clicking a link to immediately unsubscribe, almost everyone requires you to click a button after navigating to the unsubscribe link. Otherwise you have issues with link scanners unsubscribing your recipients without their knowledge. There are some more complex ways to approach this with JavaScript checks for "real browser" but IMO these are more likely to create frustrating friction to unsubscribing (by not working if the user has an adblocker for example) than having the user click a button. I've seen this pattern of unsubscribe link, then click button approved as CAN-SPAM compliant more than once so I don't think there's a legal concern. The CAN-SPAM rule seems more targeted at the systems you used to see a lot that required the user to log into their account, type in their email address, or figure out a complicated "communications preferences" list to use the unsubscribe form. check out https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-316/section-316.5 https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C... It's a little fuzzy to me how exactly to interpret this but I think you could reasonably read it as allowing even unsubscribe pages that require you to type your email address in again (even though I detest these and don't think the problem they're intended to solve is a meaningful one).

pests 3y ago
> unsubscribe pages that require you to type your email address in again These are fine for me if the email is prepopulated.

bruckie 3y ago

Google requires senders to use the `List-Unsubscribe-Post` and `List-Unsubscribe` headers, which use a POST request to avoid this problem. Details: https://support.google.com/mail/answer/81126#zippy=%2Crequirements-for-sending-or-more-messages-per-day https://support.google.com/mail/answer/81126#zippy=%2Crequir... (I work for Google, but on something totally unrelated, and don't speak for them or have any inside knowledge. I was just curious and looked it up.)