Elsevier Shows How Not To Do It

In October 2004, I registered with The Lancet to access an article. Elsevier, which publishes The Lancet, has been sending me emails ever since. After their mailing on July 11, 2008, I finally had enough. I went to their website, cleared all of the checkboxes, and considered the matter closed.

Three months later, I got another mailing from them.

That alone is a CAN-SPAM violation. The Act requires that unsubscribe requests be honored within ten business days.¹ The gap between July 11 and October 21 is not a close call.

But the more instructive problem is how Elsevier handles unsubscribes in the first place. When I went back to their site to sort this out, I found all of my preferences had been reset to opted in. To unsubscribe again, I was required to log in with a username and password, provide my specialty, work location, and country, and then uncheck the relevant boxes. That is four steps, a password, and personal information well beyond my email address.

The FTC closed this door when it promulgated CAN-SPAM rules. The rulemaking record is explicit: the Commission considered and rejected arguments that senders need additional verification steps to prevent abuse, concluding that requiring consumers to transmit personal information creates its own security risks rather than reducing them. The resulting rule is unambiguous: a sender may not require any fee, any information other than the recipient's email address and opt-out preferences, or any steps beyond sending a reply message or visiting a single web page, as a condition of honoring an unsubscribe request.²

Passwords are out. Preference centers requiring login are out. Forms asking for specialty and country are out.

This is worth keeping in mind because the Elsevier pattern is not unusual. Senders routinely dress up noncompliant unsubscribe processes as preference management. The statutory standard does not bend to that framing. A process that requires more than an email address and a single web page does not comply with 16 C.F.R. § 316.5, regardless of what the sender calls it.