Question comes in this morning:
Hey Mick? Requiring the confirmation of an email address in an unsubscription is not CAN-SPAM compliant, right?
That is absolutely correct. The current implementing rules for CAN-SPAM state:
Neither a sender nor any person acting on behalf of a sender may require that any recipient pay any fee, provide any information other than the recipient’s electronic mail address and opt-out preferences, or take any other steps except sending a reply electronic mail message or visiting a single Internet Web page, in order to:
(a) Use a return electronic mail address or other Internet-based mechanism, required by 15 U.S.C. 7704(a)(3), to submit a request not to receive future commercial electronic mail messages from a sender; or
(b) Have such a request honored as required by 15 U.S.C. 7704(a)(3)(B) and (a)(4).
(emphasis added)
My assumption in answering this question is that the issue here is that the sender wants to use a confirmed, or double, opt-out approach. This would be a violation of CAN-SPAM because requiring that confirmation step is requiring take steps other than sending a reply electronic mail message or visiting a single Internet Web page to effect the opt-out.
The technology exists to encode the recipient’s address into the URL or the reply-to field so that unsubscription shouldn’t take more than a single blank email or a visit to a single page. And since that’s what the law currently requires, that’s what you should be doing.
About the Author
Mickey is a Consultant & Attorney with over 28 years of experience in Email Deliverability & Privacy Law. He has a strong background in email authentication infrastructure (SPF, DKIM, DMARC), ISP and mailbox provider relations, anti-spam policy and compliance, CAN-SPAM and state anti-spam law gained through overseeing the Abuse & Compliance team at Salesforce Marketing Cloud, originating the ISP relations role at Informz (now part of Higher Logic), and working in the fight against spam since 1997. He holds a B.A. in Government, a B.S. in Computer Information Systems, and a J.D. from the University of Houston Law Center. He is a certified CIPP/US professional and a certified CIPM professional.
