It's shitty UX regardless of whether it's a violation of law, IMO.

Original: It's a violation of CAN-SPAM law to put unsubscribe behind a login process. Asking for a password violates the requirement that no additional PII except for the email be required to process the opt-out.

From the FTC:

Honor opt-out requests promptly. Any opt-out mechanism you offer must be able to process opt-out requests for at least 30 days after you send your message. You must honor a recipient’s opt-out request within 10 business days. You can’t charge a fee, require the recipient to give you any personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on an Internet website as a condition for honoring an opt-out request.

http://www.business.ftc.gov/documents/bus61-can-spam-act-com...

Explained at http://business.ftc.gov/documents/bus61-can-spam-act-complia... and excerpt below:

A. What matters is the “primary purpose” of the message. To determine the primary purpose, remember that an email can contain three different types of information:

1. Commercial content – which advertises or promotes a commercial product or service, including content on a website operated for a commercial purpose;

2. Transactional or relationship content – which facilitates an already agreed-upon transaction or updates a customer about an ongoing transaction; and

3. Other content – which is neither commercial nor transactional or relationship.

If the message contains only commercial content, its primary purpose is commercial and it must comply with the requirements of CAM-SPAM. If it contains only transactional or relationship content, its primary purpose is transactional or relationship. In that case, it may not contain false or misleading routing information, but is otherwise exempt from most provisions of the CAN-SPAM Act.

More on that here: http://www.the-dma.org/press/PrimaryPurposeFactSheet.pdf

Many "transactional" emails probably fail the above test. It's shitty UX to make you login to opt-out, even if it's not against the law.

That depends -- have you ever signed up with the sender? If so, you are asking to be spammed. When a company requires a signup, they are breaking the law, therefore you must not sign up. By signing up, you make the spam legitimate.

If they send you an unsolicited e-mail, they are criminals. If they require a signup to opt out, they are criminals. But if you sign up, they aren't. That's why they want you to sign up.

Even ignoring the first amendment, there is no enabling clause that grants the general power to regulate communication.

You may have the right to speak but you don't have a right to force the populous to listen.

Communication is two way, spam is one-way.

You have the right to expose people to communications with no Congressional control whatever. Congress shall make no law. You may shout on a street corner, you may set up a PA system until your neighbors are driven to madness, you may place pornography on a billboard, etc. Congress can do nothing to stop it.

Are you trolling. You consider the constitutional right to free speech to encompass things like setting up a PA in public that is so loud it physically harms people?

It's not a right to amplified speech, nor "free shouting".

Freedom of speech does NOT involve the freedom to send individually addressed messages to anyone. There is no freedom to spam.

CAN-SPAM doesn't apply to political or non-profit organizations.

If marking as spam or unsubscribing are approximately equal effort, I will unsubscribe; if unsubscribing is even slightly more difficult than marking as spam, I mark as spam with no regrets. Even if you don't force me to login but make me do some monkey trick like type "CANCEL" into a box => spam! One click is the only acceptable method, and don't hide the link in a bunch of small print legalese, because I'm not going to expend much effort looking for it while the nice, inviting "Mark as Spam" button is just sitting there waiting for me to click it.

Spam is in the eye of the recipient. If you send me marketing emails that I do not want, it is spam. Even if someone else would want it.

If people didn't mark stuff as spam, then there would be absolutely no reason for marketing people not to send spam to everyone. Even if only one person in 10,000 wants to read it, why not? But the option of marking stuff as spam is a way of making my attention as not free for you.

I don't have the link anymore because this was already a couple of years ago, was someone taking this ages-old advice to the test. Clicking the "unsubscribe" link on all spam delivered to an old spam-infested email address, he found that it reduced the amount of spam received to that address by a significant amount.

http://www.list-unsubscribe.com

https://support.google.com/mail/answer/81126?hl=en

Then the domain block goes into place. /dev/null, auto-trash, or whatever the local filter rules support.

It's a crappy process to deal with, and can affect you for a critical day or two. An example being that one of clients collected email in a greasy was, and increased their email blasts from 25,000 to 75,000.

I'm sure they wanted to reach more people, but yahoo and a few others marked ALL of the messages as spam due to massive increase in volume from this client.

Advice: Do things in a non greasy way, and while you may grow slower because of it, your users, and their email providers, will like you more for it.

This happens to me about twice a year (not a firstname.lastname, but a commonword.commonword. It's like a stupidity-driven dictionary attack). The worst companies I've had to deal with:

Steam - took me multiple emails over the course of weeks, and they actually made me send them screenshots to prove the account was mine. I only went to this much trouble because I have a legit Steam account. Especially funny since I casually told them that I was a hair trigger away from just resetting the idiot's password and hijacking his account.

AT&T - Flat-out refused to unsub me from someone else's phone bills. After several calls to AT&T I finally gave up and called the customer. An AT&T rep actually had the balls to tell me that making me do this was for the customer's protection.

Getting that first E-mail is not too bad; having to sign in to a service I never signed up for in order to stop the e-mail is the pain-point.

I wish more companies would require e-mail verification before activating accounts and sending out a flood of messages. It would also protect their customers, because it is quite easy to request a password reset and then, say, go dick with someone's data-populated chat-app settings.

I would also like to see some sort of standard - like email header with link, that would unsubscribe you. Outlook/thunderbird/etc could just show button (probably next to "mark as spam" :)) and you couldjust click and be done. I think google tried something like this, but I've never heard of anyone else.

Companies can, and do, take out lists of subscribers and pass them to agencies to run campaigns for them, with potentially long lead times. Still stupid, but that's usually the reason.

Regarding standard, the List-Unsubscribe: header is sort-of that. It's not used much because there's little reason to - most clients don't do anything with them.

- We have a complex series of integrations (marketing automation -> CRM system -> app -> transactional e-mail provider) (as one example) where propagation isn't real time and could take a few days (if say, each of these were propagated on a nightly batch).

- Something could go wrong with any of these.

- It's better to err on the side of caution and give a super-conservative estimate and always beat it by a huge margin, than give an accurate estimate and occasionally break it (particularly with something as sensitive as unsubscribes).

"Any opt-out mechanism you offer must be able to process opt-out requests for at least 30 days after you send your message. You must honor a recipient’s opt-out request within 10 business days."

which means the recipient gets 30 days (from receipt of each email) to opt out, the sender has 10 days to process the opt-out.

I'm looking at you, LinkedIn and Twitter. I've unsubscribed from about three or four waves of your bullshit. No, I don't care about what I might have "missed on Twitter". I didn't subscribe to this, you spamming fucks.

Personally I give them the benefit of the doubt and try to unsubscribe with ONE click.

There is no good reason to make people click more than once.

This means it's impossible for me to unsubscribe from all sorts of things, since 'forgot my password' with a lot of places requires a birthday, access to the phone that's on the account, answers to security questions, etc. etc.

If I click 'unsubscribe' and get asked to log in? I just go back and click 'Report Spam'.

It's ridiculous how hard some services make it. Especially banks - I had someone in the US sign up for a bank account with my email, and I was getting fairly important sounding emails (like "your account had insufficient funds to pay [automatic bill payment]" and stuff), and there was almost nothing I could do - to contact the bank, you had to log into your account and use the "secure contact form" or phone them (which would be an international call, annoying time zones, etc.). I stopped getting emails eventually so they must have figured it out eventually!

If a service makes me log in to unsubscribe from their spam, they can be assured that it will be the last time I ever log into their service.

Abuse a privilege? Lose it.

My revenge is training Gmail that email from such senders is Junk and Spam. Eventually Gmail dumps them automatically, hopefully for everyone.

I know, the "Here's an email to confirm that you hate our emails" message isn't anyone's favorite... but if it helps companies improve their unsubscription mechanisms, I can let it slide.

Happens all the time, and now you've unsubscribed someone who is a high value member of the list.

Oh, thought so.

Nobody ever complained, which kinda goes to show exactly how spammy LI is.

I never log in in such circumstances, I just hit the 'spam' button and that's that. I trust the email service to categorize the further emails accordingly and that's what usually happens.

But there's a reason, and to understand the reason, you need to understand something about the law.

You want to be taken off the mailing list of a company that technically is spamming you, violating the law. But if the company can get you to sign in first, you technically become a customer, and they can then spam you endlessly and legally.

But -- a company that requires you to sign in, in order to opt out, is breaking the law. The Can-Spam Act requires opt-out to be readily available and simple (see below). On that basis, sites that require signups to opt out are engaged in a criminal conspiracy.

From the law: "You must honor a recipient’s opt-out request within 10 business days. You can’t charge a fee, require the recipient to give you any personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on an Internet website as a condition for honoring an opt-out request."

-- http://www.business.ftc.gov/documents/bus61-can-spam-act-com...

They're breaking the law. They are criminals.

Probably the best thing to do, IMO, is a simple two click unsubscribe - take them to a page with their e-mail address already filled in, and just require them to click "OK" to confirm which address is being unsubscribed.

At multiple gigs, at multiple sites, a significant amount of bounced mail consists of messages sent to long-term undeliverable addresses (in many cases: to domains which no longer exist, and/or have been tranferred, and/or the owning company has gone out of business: think Enron, AT&T's discontinued ISP network, Lehmann Brothers, etc.).

Even if I'd _wanted_ to create rules or write scripts to automatically process the messages, the login requirements generally meant that wasn't possible. Instead, these comprised both a significant amount of outbound mail queues and nondelivery notifications, potentially masking more serious issues (you've got to come to understand what notifications are effectively part of background noise vs. not).

Oh, and some of those domains still exist in some regards (e.g., there's a skeleton crew at Lehman winding down the firm), so you can't just blindly select entire domains.

File under continuing hassles of a conscientious admin's job.

I'm still getting e-mails from them to this day.

A while back a forum spammer decided to use my Gmail address to spam forum sign-ups. I got Gmail to filter most of them into the trash (the spammer used a variation of my email address I don't use. Gmail allows variations in email addresses). Afterwards I wanted to clean things up and a lot of the senders require that I log in first to unsubscribe. That they would sign me up without verification is bad enough but requiring that I login to unsubscribe made it just too difficult. So now I just filter everything that was sent to that variation of my email and mark them all as spam.

Lose-lose for everyone.

We have a lot of other cool stuff in emails like single click logins, viewing pixels with custom payloads, our open source drip campaign mailer for Django, and much more. If there is any interest, I'd be happy to go into deeper detail.

Basically, reuse a lot of signing functions that you might find in a library (IE: Django's https://docs.djangoproject.com/en/dev/topics/signing/), don't roll your own. Then, keep track of last login IP address and block auto-logins when they mismatch. Then, set a max age for the login links to work (for example, 24 hours). There are a few other things we do as well, but those are the major ones.

Those three combined are fairly secure.

I just click on "Spam" and, if it continues, set up a filter to /dev/null.

I can't think of how many times I've had to do this. I relaly like georgemcbay@'s idea to just mark as spam. Gonna do that from now on

In my opinion, I agree. User-friendly is key. In my personal experience, users appreciate ease of access, including unsubscribing.

So there's no reason to ever have to deal with the unsubscribe links in emails. It puzzles me that people that people who use gmail still complain about this stuff. Do people not know about this feature?

There may be a way around this, but if no session was required, then couldn't someone just make a bunch of GET requests to the unsubscribe url for each user id and unsubscribe the entire user base?

If you are still a user (you unsubscribed but didn't delete your account), expect much less mail, but not quite zero.

Otherwise, search for "your mail reader" and "mark spam" and you'll probably figure something out.

I also mark such email as spam.

If I try to unsubscribe from an email list and am presented with a login prompt, I report the sender as spam without an instant of hesitation or regret.