One-click unsubscribe is a requirement for bulk senders at the large providers, and the usual implementation — a link to /unsubscribe?email=... — is both a privacy leak and a support burden. Anyone can unsubscribe anyone by editing the address.
What the link should carry
A signed token containing the contact id, the scope (marketing, product, all), and an expiry. Sign with an HMAC over the payload using a server-side key, and verify on GET before rendering the confirmation page. The email address never appears in the URL, so a forwarded message does not leak it into logs or referrer headers.
Why scope matters
One-click unsubscribe from the mail client sends a POST to the URL in the List-Unsubscribe header. That must work without a login and must take effect immediately, because the receiver's spam button is one click away if it does not. But the scope should be the stream the message came from, not every message you will ever send.
The failure to design for
Some clients prefetch links to scan them. If the link performs the unsubscribe on GET, the scanner unsubscribes the customer before they ever see the email. Serve a confirmation page on GET and require the POST to act, or accept the one-click semantic but make the token single-use and short-lived.
Store the evidence
Keep the timestamp, the source (header, link, API, manual) and the token id. When a complaint arrives, 'we unsubscribed them at 14:02 from the header' is a complete answer.
Volanea signs unsubscribe tokens per stream and records the source, so compliance evidence exists without a manual log.
Top comments (0)