How must unsubscribe requests be processed (timing, confirmation)?

Someone just clicked your unsubscribe link. What happens next matters more than most senders realize.

The legal timelines vary by regulation. CAN-SPAM gives you up to 10 business days to process opt-out requests. CASL matches that with a 10-business-day maximum. GDPR doesn't name a specific number of days, but regulators have consistently interpreted "without unreasonable delay" to mean days, not weeks. If you're sending to EU subscribers and waiting eight days to honor an unsubscribe, that's a compliance risk.

In practice, the regulatory ceiling doesn't matter much. Your real deadline is immediate. Every hour someone keeps receiving emails after they opted out is another hour they might report you as spam. ISPs notice that. Your sender reputation notices that.

What "processed" actually means

Removing someone from a single list isn't enough. When you process an unsubscribe, you need to do all of this. Add the address to your suppression list right away. Cancel any scheduled campaigns they're included in. Stop all automated sequences they're enrolled in. Make sure the suppression sticks, so if their address shows up in a future import or list sync, they don't get re-added silently.

That last point catches a lot of senders off guard. You import a refreshed CRM export next month, and suddenly an unsubscribed address is active again. Your ESP should block re-adds automatically, but it's worth checking that your suppression list is configured to work that way.

You also need to make sure the unsubscribe travels across every system that touches that address. Your primary ESP, your transactional email platform, any third-party tools with their own sending capabilities. A suppression that lives in only one system isn't really a suppression.

Confirmation pages vs. confirmation emails

And a confirmation page is good practice. Showing a clear "you've been removed" message reassures the person that it worked and reduces the chance they'll hit the spam button out of frustration.

Now a confirmation email is a different story. The person just asked you to stop emailing them. Sending them an email to confirm you've stopped is legally risky and, honestly, a bit tone-deaf. If you do send one (some senders argue it helps with re-subscribe rates), it must be purely informational. Nothing promotional. No discount codes. No "we'll miss you" upsell. Some regulations explicitly prohibit using the unsubscribe step as a marketing touchpoint.

The simpler move is a clean confirmation page, no email. It's less risk and just as effective.

If you're not sure whether your current unsubscribe flow is airtight, our SOS hotline is free and we'll walk through it with you.