Email Horror Stories, part 3 of 3

Every ignored unsubscribe becomes a spam complaint, and the complaints are what the providers count.

Part one was the dead list and part two was the cold sender. Part three is the dead coming back to life, because someone unsubscribed and kept getting mail anyway.

Most fundraising teams know they should honor opt-outs. What's harder is knowing how fast to act, and whether the rules reach a campaign or a nonprofit at all. The legal clock and the provider clock aren't the same, and for political senders the legal answer is less obvious than people assume. None of this is legal advice. Where the law is unsettled I say so and flag it for counsel.

Back from the dead

Validity's 2026 benchmark describes the mechanism: subscribers often use the "this is spam" button interchangeably with unsubscribing, but high complaint rates hurt a sender's reputation and deliverability, and unsubscribes don't (Validity 2026 Benchmark Report). Every opt-out you fail to honor, or hide, is a person who will reach for the other button. As the last post covered, Google wants complaints under 0.1% and never at 0.3%, and the average sender in Validity's data sits at 0.06%.

The header ritual

RFC 8058 defines one-click unsubscribe. You add a List-Unsubscribe-Post header containing List-Unsubscribe=One-Click next to a List-Unsubscribe header with an HTTPS URL, and you sign at least one valid DKIM signature that covers both headers. A mailbox provider can then unsubscribe someone by sending an HTTPS POST to that URL (RFC 8058). The standard exists because anti-spam software that fetches header URLs would otherwise unsubscribe people by accident.

Google requires this from senders of 5,000 or more messages a day: marketing and subscribed messages must support one-click unsubscribe and carry a clearly visible unsubscribe link in the body (Google sender guidelines). Its FAQ adds that one-click is required only for marketing and promotional messages, that transactional messages are excluded, and that mailto and plain URL links don't meet the requirement (Google FAQ). The same page says message recipients, not Google, determine the nature of the messages they receive, which makes "we're a campaign, not a marketer" a risky bet. Yahoo asks bulk senders for one-click and calls the RFC 8058 method highly recommended (Yahoo). Gmail's verified sender program for political committees recommends it too (Gmail Verified Sender Program policies).

The clocks

CAN-SPAM gives a sender up to 10 business days to honor an opt-out, and the opt-out mechanism has to keep working for at least 30 days after the message goes out (15 U.S.C. 7704; FTC compliance guide). Yahoo says to honor unsubscribes within 2 days (Yahoo). Google recommends 48 hours, and its sender-requirements table lists unsubscribe requests not honored within 48 hours as an issue that makes delivery support and mitigations unavailable (Google FAQ). The page doesn't reconcile the two statements, so treat 48 hours as the real deadline.

The legal clock runs about two weeks and the provider clock runs two days, so a weekly batch job that passes the first one fails the second.

Is your fundraising email even covered?

CAN-SPAM covers a "commercial electronic mail message," meaning one whose primary purpose is the commercial advertisement or promotion of a commercial product or service (15 U.S.C. 7702). That definitions section doesn't mention political, nonprofit or charitable messages at all.

The FTC's guidance is thin. Its compliance guide doesn't address political or nonprofit email. A 2015 FTC business blog post says CAN-SPAM applies only to commercial email and not to non-commercial bulk email, and that political messages are protected by the First Amendment, but it doesn't say whether a nonprofit's fundraising appeal counts (FTC blog). The FTC's 2008 rulemaking adds that CAN-SPAM does not set up a dichotomy between commercial and nonprofit messages, so a nonprofit whose email primarily promotes a commercial product or service gets treated like anyone else (FTC 2008 rule). A 2024 North Carolina Law Review article says political organizations aren't legally required to include unsubscribe links, though most do anyway (N.C. L. Rev. 102).

Put together, a plain donation or volunteer appeal probably sits outside the statute's definition. A merchandise email probably doesn't, since a hat or a T-shirt is a commercial product. That second half is my reading of the definition, not an FTC ruling I can point to, and mixed emails are where it gets hard. Confirm with counsel before treating any stream as exempt.

Exempt or not, the providers don't care about your tax status. Their rules look at the message and at what recipients make of it.

What it costs

The FTC's penalty ceiling is up to $53,088 per violating email (FTC compliance guide). In a September 2026 notice, the FTC said its civil penalty amounts stay unchanged for 2026 and that it will keep applying the 2025 levels (Federal Register notice). The FTC, state attorneys general and internet access providers can enforce CAN-SPAM, and the statute doesn't give consumers a private right to sue (15 U.S.C. 7706).

For scale, the FTC's August 2024 settlement with Verkada was $2.95 million, which the agency called the largest penalty it has obtained for a CAN-SPAM violation. It alleged more than 30 million commercial emails over three years, including failures to honor unsubscribe requests (FTC press release).

State law

CAN-SPAM supersedes state laws that expressly regulate commercial email, except to the extent they prohibit falsity or deception, and it leaves general laws such as fraud and computer crime alone (15 U.S.C. 7707). That is why the state statutes people mention mostly target misleading email, not unsubscribe timing.

Washington's CEMA defines a commercial electronic mail message as one sent to promote real property, goods or services for sale or lease (RCW 19.190.010). A 2026 amendment, HB 2274, took effect on 11 June 2026 and sets recipient damages at $100 or actual damages, down from $500 (RCW 19.190.040; DLA Piper summary). California's Business and Professions Code 17529.5 similarly targets deceptive commercial email advertisements and allows private suits (Cal. BPC 17529.5). Whether a campaign appeal counts as commercial under either state's definition is unsettled in anything I could find. Confirm with counsel.

Composite scenario: the weekly batch

Composite scenario. No real organization or person is depicted. A national advocacy nonprofit runs a donor list and an online merch store. A vendor processes unsubscribes in a weekly batch, and the email header carries only a mailto unsubscribe.

What went wrong:

• Monday: a supporter clicks unsubscribe.
• Wednesday: the merch sale email goes out. The supporter is still on the list.
• Wednesday: they hit "Report spam."
• Over the next two weeks: Gmail complaints climb past 0.3%.
• After that: the domain is ineligible for mitigation support and the fundraising sends start landing in spam.

How it should have gone: suppress on click, not weekly. Add RFC 8058 headers signed under DKIM. Share one suppression list across every vendor. Ask counsel which streams count as commercial, and hold all of them to the stricter provider rules anyway.

Don't be this sender

1. Your unsubscribe is a batch job.
2. Your header lacks List-Unsubscribe-Post.
3. Your vendors keep separate suppression lists.
4. You've never asked counsel which messages are "commercial."
5. Your unsubscribe link is hard to find, so people hit "spam" instead.

That wraps the series.