Unsubscribe Page Best Practices: One-Click Opt-Out Done Right

An unsubscribe page is the least glamorous asset in your email programme and one of the few that can quietly destroy it. Everyone who wants out will get out. The only variable you control is whether they leave through your unsubscribe link or the “report spam” button, and those two exits have very different prices.

Why opt-out friction costs you money

The authors of RFC 8058 put the commercial logic in the specification itself: mailers want to make unsubscribing as easy as possible, because if the process is too difficult, the recipient’s alternative is to report the mail as junk until it stops appearing in the inbox.

That substitution is the whole argument. An unsubscribe removes one address from one list. A spam complaint is recorded against your sending domain and IP and counted alongside every other complaint you generate. Google asks senders to keep the spam rate in Postmaster Tools below 0.10% and to avoid ever reaching 0.30% or higher; since June 2024, bulk senders above 0.3% are ineligible for delivery mitigations and regain eligibility only after seven consecutive days below it. Yahoo also asks bulk senders to stay below 0.3%.

So the person you made jump through three screens does not just leave. They take a piece of your inbox placement with them, for every future campaign, including the ones sent to people who still want your mail.

How one-click unsubscribe actually works

Most “one-click unsubscribe” advice conflates two different mechanisms that mailbox providers treat differently.

The two headers

RFC 8058, published in January 2017, defines the mechanism. A sender that wants one-click support places one List-Unsubscribe header field and one List-Unsubscribe-Post header field in the message. The former must contain one HTTPS URI, and may also contain non-HTTP URIs such as a mailto. The latter must contain the single key/value pair List-Unsubscribe=One-Click.

List-Unsubscribe: <https://example.com/u/9f2a1c7b>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The mailbox provider then performs an HTTPS POST to that URI with the key/value pair as the request body. The RFC says the content should be sent as multipart/form-data, or may be sent as application/x-www-form-urlencoded.

POST /u/9f2a1c7b HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded

List-Unsubscribe=One-Click

Four details in the RFC are the usual cause of a “compliant” implementation that does not work:

• The message must carry a valid DKIM signature covering both headers, listed in the signature’s h= tag. Without it, receivers should not offer one-click at all.
• The URI must identify both the recipient and the list, because there is no way to ask the user which address to remove.
• The URI should include an opaque or hard-to-forge component that your server verifies, which stops an attacker mailing forged List-Unsubscribe links for someone else’s list.
• The POST must not include cookies or HTTP authorization, and your endpoint must not answer with a redirect.

What mailbox providers require

Google’s sender guidelines state that senders of more than 5,000 messages per day must support one-click unsubscribe on marketing and subscribed messages, and must also include a clearly visible unsubscribe link in the body. Google is specific that a body link is not a substitute: if the List-Unsubscribe header is missing it does not scan the body, and a mailto link in the body does not satisfy the requirement.

Yahoo’s bulk sender requirements ask for a functioning list-unsubscribe header supporting one-click on marketing and subscribed messages, note that the RFC 8058 POST method is highly recommended while the mailto method is acceptable, and separately ask for a visible body link that may point to a preference page. That mailto difference is real: Yahoo accepts it, Google does not.

Both limit the requirement to marketing and promotional mail. Google excludes transactional messages such as password resets and reservation confirmations, and Yahoo’s FAQ says the same.

The honouring timeframe

Google’s FAQ recommends fulfilling unsubscribe requests within 48 hours, and its table of failure conditions lists requests not honoured within 48 hours as a reason a bulk sender loses access to delivery mitigations. Yahoo’s requirements say to honour unsubscribes within 2 days. Design for immediate suppression anyway: 48 hours is a ceiling for batch systems, not a target.

How this differs from a link that opens a page

One-click via headers never touches your website in the user’s browser: no page load, no consent banner, no JavaScript, no session. The provider posts to your endpoint in the background. The body link is the other path, the one that lands on a page you designed. Both need to work, for different reasons.

What a good unsubscribe page does

The page has one job: end the relationship the reader asked to end. Five properties cover almost all of it.

• It loads fast and works everywhere. Assume a mobile browser, a slow connection, and a client that blocks your scripts. If the page needs a tracking bundle to render, the unsubscribe is broken.
• It requires no login. Yahoo’s best practices state this outright, and CAN-SPAM makes it a legal problem in the US too.
• It confirms in one action. Arriving either completes the unsubscribe or leaves a single obvious button that does.
• It states exactly what changed. “You have been removed from the weekly newsletter. You will still receive order confirmations.” Ambiguity produces a later complaint from someone who thought they had opted out of everything.
• It offers an undo. A visible “resubscribe” link rescues accidental clicks.

Dark patterns and why each one backfires

• Guilt-trip copy. The sad mascot and the “are you sure you want to miss out?” line convert a neutral exit into an irritated one. The only thing left to change is whether the reader leaves annoyed enough to hit the spam button next time.
• Buried or low-contrast controls. Six-point grey text in the footer does not reduce unsubscribes, it redirects them into complaints.
• Forced surveys. Making “why are you leaving?” a required step turns an obligation into a data collection form, and under CAN-SPAM you may not require information beyond an email address or any step beyond visiting a single page.
• Multi-step confirmations. Every extra screen is another chance for the page to fail, the session to drop, or the reader to report spam instead.
• Login walls, account deletion framing, and asking people to retype their address. Anyone whose display address differs from the subscribed one will type the wrong thing. Encode the identity in the link instead.

Preference centres, and where they stop helping

A preference centre genuinely helps when the reader’s problem is not you but your cadence. Three options carry most of the value: frequency (weekly instead of daily), topic (restock alerts but not the newsletter), and pause (a 30 or 90 day break with a definite end date). Each retains a subscriber who would otherwise be gone.

It becomes an obstacle the moment it is the only exit. The rule is worth writing into your brief: a global unsubscribe must always remain one click away on the preference page, at the same visual weight as the other options, with no confirmation step behind it.

Note also that header-based one-click removes the recipient only from the list associated with that message. If an address maps to several lists, decide whether a header unsubscribe means “this list” or “all marketing”, and say which on the confirmation page.

Processing the request: suppression that holds

Suppress immediately and globally by address, not by list membership. Removing a contact from a list is not suppression, because the next import can add them back. A suppression record is a separate, permanent assertion that this address must not receive marketing mail, checked at send time regardless of which list, segment or workflow produced the send.

Opt-outs have no expiry, and the record must survive platform migrations. That is where most real damage happens: a business moves email platforms, exports contacts, imports them into the new tool, and silently resurrects years of unsubscribes. Move your suppression list first, before any contact data, and verify the count on the other side.

The same failure happens whenever two systems disagree. A store platform, a CRM and an email platform each hold a marketing consent flag, and a nightly sync overwrites the one that was correct. That is an integration problem rather than a legal one: the unsubscribe was captured properly and then lost in transit. If you connect a store to Brevo through a connector such as Tajo, check what it does with unsubscribed contacts on every sync, not just the first import.

Two more rules worth enforcing in code. Never re-add an unsubscribed address through a later import, list purchase, enrichment tool or re-engagement upload. And log the timestamp and source of every opt-out, because when someone claims they never unsubscribed, that record is the answer. Keep the endpoint available too: Yahoo says a non-functional unsubscribe fails the requirement, and Google warns that a link broken for an extended period means messages no longer meet it either.

What the law actually requires

United States: CAN-SPAM

The FTC’s compliance guide sets out what the law requires. Your opt-out mechanism must remain able to process requests for at least 30 days after the message was sent, and you must honour a request within 10 business days. You may not charge a fee, require personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on a website. You may offer a menu of options, but it must include the option to stop all marketing messages from you. Once someone has opted out you may not sell or transfer their address, other than to a company hired to help you comply. Each violating email carries penalties of up to $53,088. CAN-SPAM is an opt-out regime: no consent is needed before the first message.

European Union: GDPR and ePrivacy

The EU position is the reverse. Article 13(1) of Directive 2002/58/EC allows electronic mail for direct marketing only in respect of subscribers or users who have given prior consent. Article 13(2) carves out the soft opt-in: if you obtained the address from your own customer in the context of a sale, you may market your own similar products or services, provided the customer is clearly and distinctly given the opportunity to object, free of charge and in an easy manner, both at the time of collection and on the occasion of each message. Article 13(4) prohibits marketing mail that disguises the sender’s identity, or that has no valid address to which the recipient can send a request that the communications cease.

GDPR adds two duties. Article 7(3) gives the right to withdraw consent at any time and states that it shall be as easy to withdraw as to give consent. Article 21(2) gives an unconditional right to object to direct marketing at any time, including related profiling, and Article 21(3) says the data must then no longer be processed for those purposes. In short: your unsubscribe cannot be harder than your signup form was, and there is no balancing test once someone objects.

Required versus best practice

For the EU picture in full see the GDPR email marketing guide, and for consent capture the double opt-in guide.

What to measure

Track unsubscribe rate per campaign, but frame it honestly. Published benchmarks vary widely by industry, list source, send frequency and how the sender defines the denominator, so any single number quoted as “the” benchmark is worth less than your own trailing average. A campaign that doubles your normal rate is telling you something specific about that campaign.

Complaint rate is the more important signal, because it is the one mailbox providers act on. Gmail exposes it in Postmaster Tools, Yahoo through its Complaint Feedback Loop. Treat the thresholds above as ceilings.

The trade-off is the part people get backwards. Making the unsubscribe easier to find usually raises the unsubscribe rate and lowers the complaint rate, and that is a good trade every time: a list that shrinks by the people who wanted to leave reaches more inboxes than one padded with reluctant recipients. If both rates rise together, the problem is not the page but relevance, frequency, or how the addresses were acquired. Our guides to deliverability, list cleaning and why emails go to spam cover the diagnosis.

The exit survey, done tastefully

Knowing why people leave has real value, and you can collect it without breaking anything. Three conditions:

• Optional. No required field, no submit button between reader and door.
• After the fact. Show it on the confirmation page, once the unsubscribe has taken effect and the page says so.
• Short. One question, four or five options: “too many emails”, “not relevant”, “never signed up”, “content quality”, “other”.

“Never signed up” is the most valuable line in the survey. If it climbs, you have an acquisition problem, and the fix is upstream.

Key takeaways

• Easy opt-out is a deliverability control, not a courtesy. The alternative exit is the spam button, scored against every future send.
• Implement RFC 8058 properly: both headers, an HTTPS URI identifying the recipient, a hard-to-forge token, DKIM coverage, no redirect on the POST.
• Honour requests immediately. Gmail’s window is 48 hours, Yahoo’s is 2 days, CAN-SPAM’s is 10 business days.
• Keep a permanent suppression list, migrate it before your contact data, and never let an import overwrite it.
• Judge unsubscribe rate against your own baseline, and treat complaint rate as the number that decides inbox placement.