Some large companies even flagrantly violate the extremely lax rules that exist in the States. Guitar Center has infamously been sending me emails that are in direct violation of the one click unsubscribe regulations for almost a decade now. I can’t even sign in to the account to cancel the emails (which is in direct violation of the regulation- it is ambiguous on a lot of things but the one thing that it isn’t is that you aren’t supposed to be required to log in to opt out of email communications) because it was made with my dad’s email from 20 years ago yet I’m the recipient of the spam.
I did report them; but of course nothing must have happened because they are still doing it.
The LinkedIn way.
In the UK, it appears to be illegal to even develop a website or app that "instigates" a user to invite their friends to that website or app. This includes pre-filling an email that they send their friends. So, any sort of viral mechanism that people on YCombinator and Hacker News have used to grow their websites with "hockey stick growth" is illegal in the UK since 2020:
https://dpnetwork.org.uk/opinion/refer-a-friend-viral-market...
“An online retailer operates a ‘refer a friend’ scheme where individuals are given 10% off their orders if they participate. The individual provides their own name and email address and the retailer automatically generates an email containing its marketing for the individual to send to their friends and family. The retailer is instigating the direct marketing therefore they have responsibility for complying with the PECR rules. Because the retailer does not have the consent of the friends and family these emails breach PECR.”
That's right, the UK is policing what businesses can provide for people to privately send their own friends! There is simply no easy way for your users to legally invite their own friends to your site, so it can never reach critical mass. This would probably destroy the business model of 99% of YCombinator's B2C companies, Facebook, Twitter, and any website with "invite a friend to do X with you" functionality.
Referring friends and family by sending emails on your own? Who the fuck does that since ~2010? Ever heard of social media and instant messengers?
Social media MAY be an exception, but that's because people are already used to receiving a ton of spam on it, so your "viral post" will be ineffective to begin with, and probably filtered by Facebook and not shown to most people at all. Enjoy.
All the original social platforms such as Facebook and Twitter used ways to invite others by email (famously in Harvard etc.) So now they are burning the bridges behind them and no one can do it anymore.
And then there's those online stores that cover the entire page in a popup that you can get a 20% discount code if you give your email. Technically I've opted into their marketing. But I always just use the coupon and then report the email as spam without bothering to unsubscribe.
A few times I've had unsubscribe links absent or not working for whatever reason and done that and a human's replied and sorted it out.
(An attacker used the paypal guest account feature and used my IBAN [european bank account number] and tried to hide the mail within those hundreds of mails. They were successful for some days, until the purchase showed up on my bank account)
Also there are separate email marketing laws.
A decade ago I went to my country's embassy to renew my passport, and they now use my email to subscribe me to the newsletters of any new political party. All unsubscribe links just 404s. Shameful behaviour.
Anything I receive from any of their political candidates goes straight to spam now. The hope is that I am training the spam filter so it marks those as spam for all other users as well.
It's simple really: have clearly visible, working unsubscribe link in the body of the email that doesn't require jumping through hoops, and be from a company I know and use. Otherwise the spam filter learns about it.
Lot of people, especially of the older generation, forward all sorts of emails to their friends and family every day. If one person who received a forwarded email doesn't like it and clicks the unsubscribe link, the original recipient (who clearly likes the email enough to forward it around) gets unsubscribed. That's a bug. If you don't like the unfunny newsletter your uncle keeps forwarding you, that's a problem between you and your uncle, not between your uncle and his newsletter!
The email submission form exists to ensure that the person unsubscribing is the person who is actually on the mailing list. It will not prevent an annoyed nephew from deliberately unsubscribing the original recipient, but it will prevent most cases of mistake.
Similarly, many unsubscribe links require two clicks instead of one, because email services used to check out every link they found in the body of an email. A one-click link would instantly unsubscribe everyone before they even read the email. Nowadays we have better protocols and better email scanners, but old industry habits die hard.
That comment explains that there's a scenario where people can be accidentally unsubscribed in the presence of mail forwarding, and the requirement to enter an email address can patch over this.
Thankfully I don't have people forwarding emails to me outside of work...
The page can prompt the email address, and have a simple unsubscribe button. Not perfect, but okay.
Even better, one-click unsubscribe features (e.g. Gmail's App) are presumably set up to work for the current recipient (not the original sender) so the problem is resolved for anyone using an email client with inbuilt unsubscribe.
The forwarding problem is only for html link unsubscribe. Personally I hate trying to play find-the-ubsubscribe-link, so I use the email client feature where possible (which also helps Gmail rate/flag spam).
Mostly I haven't had problems with repeat spammers, except a republican politician (I'm not in the USA so doubly annoying).
I understand the parent's sentiment because we all want to unsubscribe from unwanted emails. But technical standards can't distinguish unwanted emails from business-critical emails. You could legitimately cause someone damages by silently unsubscribing them from an important news feed. (Imagine that you silently unsubscribed an open-source maintainer from all github notifications!) Even worse, this kind of vulnerability disproportionately affects senders who try to follow the rules and make it easier for people to unsubscribe. Spammers don't care and keep spammin'.
Ideally, an email would have both a one-click List-Unsubscribe header and an HTML unsubscribe link in the body. The latter need not be one-click, and in fact, if it's anything remotely important, should not be.
Do open-source maintainers forward around their unsubscribe links in practice?
The other problem with email scanners clicking links automatically can be solved without prompting for the email address. One simple solution is: if the link is clicked within a minute or so after sending the email there's a chance the clicker is an automated system. Instead of unsubscribing right away, serve a HTTP POST form with a single "Confirm Unsubscribe" button. Normal users will rarely see the form, automated systems will hesitate to fire off HTTP POST requests.
It absolutely should be one-click.
I’m a republican (also not in the US sense — I want to get rid of the tie to the monarchy) but I also find that republican politicians seem to be really annoying!
Some people have come up with a trick to hide the unsubscribe link with CSS when it is inside a <blockquote> tag, as in a forwarded email. It doesn't work reliably, though. HTML email is still stuck in the 90s, it's impossible to do anything fancy inside of it. Much easier to send the user to a real web page for an actual transaction.
Email providers autoclicking on links, is the recipient's problem. This is the same flow used for account verification links and yet you do not see them adding an additional step to it.
And then we have the large number of users complaining about this, and yet they feel they simply know better and reserve the right to impose themselves on us?
This decision is purely self serving, let's not pretend otherwise.
You can probably guess how effective that is. In practice, unless you can get the FTC or a state attorney general to sue an actual company for you, nothing will ever come of it.
these are spammers, not cases where you ever actually signed up to some kind of legitimate newsletter or discussion group. to pretend good faith is your first mistake...
https://en.m.wikipedia.org/wiki/Feedback_loop_(email)
Further, pixels can be embedded in the email so they can see when you open the email and how many times.
The sender has every incentive to properly handle unsubscribe to avoid spam traps. If you get big enough, users WILL come sign up for your service with a known spam trap email. If your operations are as sloppy as you’re suggesting, your email sending capabilities go poof.
I think this risk is overstated. Individual spam recipients in the United States have no standing to sue under CAN-SPAM; only the FTC does, and there's a high bar to get their attention.
my university spams me. i bought a torch from olight. they spam me. i get food deliveries. they spam me. i bought some tech. they spam me. i look for real estate they spam me. i get a delivery. they spam me.
it's differentiating between the two that's unrealistic.
There is definitely a punitive cost for sending emails that are repeatedly marked as spam though. You also can’t just cycle IPs because a brand new IP with zero sender reputation is treated with almost as much suspicion by the big player as one that is known to be a spammer.
It’s much better to give people an option to opt out, and to honour it. Most of the email sending providers (e.g., SendGrid, mailchimp, etc) force you to include the link and automatically block future sending to that address. Some will even provide you the option to provide a reason, where you can specify “I did not sign up for this” which in sufficient number will flag the sender account. I suspect the vast majority of cases where people unsubscribe but continue to get email is actually some incompetence from not having multiple disparate email systems sync back to a shared do not contact list (rather each system is maintaining its own).
Click the unsubscribe button.
The dialogue goes something like this:
robert: you know I'm retired from hero work.
Edna:As am I, Robert, yet here we are.
so now it's 2023. you're telling me it's now safe to click on unsubscribe to the spam emails.
yet here we are.
no, the strait forward response is to ignore and mark as spam any unsolicited emails you did not explicitly sign up for. don't try to interact through the desired or expected channels of any entity that spams you.
Your reasons are not actually rational.
i appreciate its impossible to prove a negative (everyone could be doing something they have no evidence or documentation of doing), but given my mail provider both says that you have to mark a selection before they'll share such information with partners and that marking emails as spam still trains your own user specific spam filter, i don't think (and an really hoping) this is not a universal thing.
I worked on an email system that sent billions of emails a month. We used these messages from providers to ensure we never sent them an email again to prevent hurting our reputation. (Marking an email as spam, is by itself, a very low signal on reputation, unless some massive % of recipients mark it as spam. Sending an email to someone who has already indicated you are sending them spam is a high signal that you’re sending spam, however).
It doesn’t even matter when you do it. We had people (outliers) who would go back and hit every single email we sent them for the last 6 years as spam, after a bad customer service interaction, not getting a refund, or whatever pissed them off. We actually investigated all outliers. Most people didn’t report spam on anything older than 6 months.
For more shady stuff I have some throwaway mail at some free mail provider.
Unsubscribing from an email just unsubscribes from that one list. They don't show any other lists or categories (or imply there are more) during this process.
Once you login you are greeted with a multi-page disaster to manually untoggle each of the near 100 list types.
Then when they add new notifications it is auto-on for everyone.
So if anyone has ideas for connecting with your local community, I’m still looking…
Which are usually just black people existing or generic "people walking by my house" reports.
At least it’s on brand. Once you start reading you will be so in awe of the insane and sociopathic people who do the bulk of the posting.
The special award though, must go to Wal-mart. That company doesn't exist in my country. I obviously never interacted with them in any way. I still get their "newsletter", and sure enough, it's authenticated to come from their domain.
I started doing this years ago after watching a talk by some Gmail devs on how they think of spam. They said they internally - controversially - redefined spam to be any email the user doesn’t want to receive. Well guess what? I don’t want to receive shitty marketing emails after I unsubscribe. If you send them to me, I’ll get you listed as a spammer.
I encourage everyone else to do the same thing. Life is too short to put up with this crap.
The threshold is "spam rates reported in Postmaster Tools below 0.3%".
That sounds pretty low to me, but I'm not in the bulk email business. I guess maybe a very small number of users actually report spam? Or maybe Google is being strict.
Source: https://support.google.com/mail/answer/81126#zippy=%2Crequir...
(I work for Google, but on something totally unrelated, and don't speak for them or have any inside knowledge.)
Listen dude, it's spam. I can give you my personal definition of spam, which I hope is illuminating: if it's not transactional and not from a personal sender, it's spam. You can ask your users to define spam, it will reduce to more or less what I described. Tough cookie!
I think this is, generally, the correct approach. There isn't really a salient reason to discriminate between "email I don't want from someone I don't know" ("true spam", if you will), and "email I don't want from someone I do know" (aggressive newsletter campaigns et al). Spam is the button to send a signal that you got an email you didn't want.
> My reaction there is to remove the reporter from all lists because the amount of damage a single spam report can do is immense; a single spam report can block delivery for weeks at a time to the 10k others that legitimately requested messages.
This is the system working as intended to me, as the customer of the email service. I like that my email provider is throwing their weight around to put the fear of God into bulk senders and forcing them to think about how this campaign will impact their sendability. I would much rather annoy the hell out of bulk senders than cede emails to spammers like we have with phones.
In most other cases (e.g. newsletters sent based on a tiny pre-checked checkbox or without asking for consent), the spam button is of course the right tool.
Sounds like it's working as intended.
And Yahoo is the Single worst email service to send to. I have AFP, dmarc, dkim, reverse dns for the Mailserver and have tested the wording with multiple mail testing services to make sure it doesn't have keywords that get automatically flagged
And yet after like 50 emails to parents with yahoo email addresses they are giving me errors because of "unusual volume of emails from your domain"
There is no form, no human to talk to and they just block you.
Angry parents come to me or course because they never redeived the activation link
There would be other ways to clog the system using trashmail providers but thankfully no student cared enough for that yet
Am I crazy or just missing some super obvious gap with this path?
If you can convince everyone to trust you, and your service, and that it'd be worth it for mail providers to do all that work on their end on top of everything they're doing currently to prevent spam, it really could improve deliverability.
You'd have to do a lot if work to validate new senders long before they send their first message and you start getting complaints or else you're just letting spammers pay you to completely bypass every mail provider's spam filters until they finally get blocked and have to create a new account with you under a different company name.
Why would you need to do that? Just work with those that'll pay you for it. The others won't care as they'll just ignore the header.
I suppose that really you'd be able to get a lot of utility by convincing just a handful of very popular email providers (gmail) to trust that your service will never be used to send spam (or that they should let spammers who slip by you right past all of their spam filters). The more email providers you can get to use your service though the more you could charge the mass mailers for guaranteed message delivery.
Such a service could lead to two very bad outcomes though. Parents being told that if they want to get email from the school they'd better sign up for an email account at one of the few supported email providers (gmail) and/or (if it becomes successful) any sender who isn't paying for the privilege of sending email being treated like a spammer.
This is often not a non-sense complaint. A lot of newsletter signups are still via pre-selected checkboxes that are easy to miss.
That would get you added to a "never block mail from this domain" whitelist that had higher precedence than everything else.
Scandalous, it's almost as if the established major providers have a financial interest in making it difficult for smaller providers and individuals to send mail using their own domains!
During the pandemic we had a lot of problems with the confirmation email for our 5000 T.A. in the virtual campus of the university. I had to guess what was happening because I was not part of the administration team, just collecting forwarded messages form the T.A and guessing:
* Gmail: Most of the time it works.
* Yahoo: The server receives a few hundred emails per day and the other are delayed. These were confirmation emails with half an hour tolerance, if they were lucky to pass the next day they were not useful. (After a week the sending server stops retrying.)
* Hotmail: Sometimes the email is received and sometimes it just disappears. No spam folder. No bounce email. It just evaporate. (Try sending an email from hotmail to the no-reply address and cross your fingers.)
* Others: No enough data to have a good guess.
Gmail will do this too. Happened a few months ago with a single (important) message from a private individual sender on Hotmail, one unknown to my Google account. The fix was adding the Hotmail address to a Google Contact.
I hope they not. Gmail spam filter is far from being perfect and classifies many non spam messages/senders as spam. May be because they heavily rely on user reports (to train AI?) and email users tend to report all kind of emails as spam including clearly ham messages like bank statements, appointment notifications, password reset emails e.t.c.
Never interact with spam. Unsubscribing just tells spammers that your email address is actively being checked, and that you're the kind of person who clicks on links found in unsolicited messages. It can even end up getting you more spam (as you've noticed), and what looks like an innocent unsubscribe link can actually take you to a malicious website instead. You've really got nothing to gain by touching spam at all.
The best way to deal with the spam that makes it into your inbox, especially spam that comes from specific senders with predictable subject lines/body content like newsletters, is filtering. For example, just auto-delete anything from a domain you never want to hear from again. You never see it, and you leave them spending at least a little time/effort shouting uselessly into the void.
I tend not to auto-delete directly, but have things filtered into specific folders just in case. It takes almost no time to clear out when they get very full. Most filters are set once and forget.
This only applies to scam emails like newsletters from sketchy domains that you never signed up for, which are sent out specifically to find active email addresses. For those, clicking the "unsubscribe" link is indeed counterproductive.
For actual businesses like Linkedin though, it makes more sense than not to unsubscribe from unwanted emails anytime they're sent. On occasion you'll find yourself back on a different newsletter list, but it's relatively rare and more often than not just incompetence rather than malice; legitimate companies want to send their emails out to people who buy stuff, not people who mark them as spam and lower their reputation.
Why? What's in it for you?
You filter them = never see the spam they send you again
You unsubscribe = pray that it's not a phishing email disguised as linkedin spam, hope that if it's real they don't just start sending you different spam, and that maybe they haven't agreed to sell your (now confirmed as more valuable) email address to 3rd parties (aka, their "partners") now that you've made that email address worthless to them otherwise.
The absolute most you can ever hope for in the "unsubscribe" case has the exact same outcome as the "filter" case, while the filter case has less risk and as a bonus lets the spammers waste their time.
Yet there are people here on HN telling us that we have some kind of responsibility to watch ads, not block them, and support the kind of people who do this slimy, evil, unethical bullshit.
They already have my e-mail address, likely even verified. They're also somewhat normal companies, i.e. they have an address where the local DPA can send a friendly reminder, and while they will happily pass your (likely hashed) e-mail address to Facebook for ad targeting, actual selling to spammers is incredibly rare.
I often can't just filter the domain because I might actually need to deal with the company again (if I boycotted everyone who acts like a dick I'd be living in a cave).
Also, for many, unsubscribe actually works.
I hope they make it really strict. I'm sick of companies that send you spam ("newsletters") just because you interacted with them once, then when you unsubscribe, you get unsubscribed from that one list, so they keep spamming you just with a slightly different newsletter type. (Edit: Also, everything requiring a notification - by e-mail if they couldn't get me to install their app - just to get me to engage with their site.)
Once such behavior has the potential of landing your entire domain in the spam folder, maybe they'll be more careful.
Edit: For example, I can't imagine LinkedIn being able to pull of their "phish people, steal their address book, spam each contact three times with no opt-out" bullshit for so long if strict spam thresholds were in place.