This may actually be against the CAN SPAM Act of 2003, which requires that non-transactional unsolicited commercial mail provide a means of being removed from the mailing database through the same means that the mail is sent.

IANAL, so I don't know if logging into an account would count or not. Personally, I see it as a hindrance to unsubscribing and by my reading of the CAN SPAM Act, it is illegal, but.. not a lawyer.

EDIT:

From https://www.ftc.gov/tips-advice/business-center/guidance/can... (which isn't the Act itself, but an FTC compliance guide):

    Honor opt-out requests promptly. Any opt-out mechanism you offer must be able to process opt-out requests for at least 30 days after you send your message. You must honor a recipient’s opt-out request within 10 business days. You can’t charge a fee, require the recipient to give you any personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on an Internet website as a condition for honoring an opt-out request. Once people have told you they don’t want to receive more messages from you, you can’t sell or transfer their email addresses, even in the form of a mailing list. The only exception is that you may transfer the addresses to a company you’ve hired to help you comply with the CAN-SPAM Act.