So many email security systems preemptively access every URL in messages. I found that I receive a GET for virtually every unsubscribe URL I send out.

I don't read clicking a "confirm" button as a second action. The attorney didn't either. He also said CAN SPAN doesn't apply to a 501(c)3. I still try to comply to be a good citizen.