11–20 of 137 posts
On one hand, I do agree that it is very annoying. However, I can kind of understand. There may be a way around this, but if no session was required, then couldn't someone just make a bunch of GET requests to the unsubscribe url for each user id and unsubscribe the entire user base?
On one hand, I do agree that it is very annoying. However, I can kind of understand. There may be a way around this, but if no session was required, then couldn't someone just make a bunch of GET requests to the unsubscribe url for each user id and unsubscribe the entire user base?
Well, I think most professional developers would use a GUID for each user anyway. Good luck bruteforcing that.
It's shitty UX regardless of whether it's a violation of law, IMO.
Original: It's a violation of CAN-SPAM law to put unsubscribe behind a login process. Asking for a password violates the requirement that no additional PII except for the email be required to process the opt-out.
From the FTC:
Honor opt-out requests promptly. Any opt-out mechanism you offer must be able to process opt-out requests for at least 30 days after you send your message. You must honor a recipient’s opt-out request within 10 business days. You can’t charge a fee, require the recipient to give you any personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on an Internet website as a condition for honoring an opt-out request.
http://www.business.ftc.gov/documents/bus61-can-spam-act-com...
A while back a forum spammer decided to use my Gmail address to spam forum sign-ups. I got Gmail to filter most of them into the trash (the spammer used a variation of my email address I don't use. Gmail allows variations in email addresses). Afterwards I wanted to clean things up and a lot of the senders require that I log in first to unsubscribe. That they would sign me up without verification is bad enough but requiring that I login to unsubscribe made it just too difficult. So now I just filter everything that was sent to that variation of my email and mark them all as spam.
Lose-lose for everyone.
It's a crappy process to deal with, and can affect you for a critical day or two. An example being that one of clients collected email in a greasy was, and increased their email blasts from 25,000 to 75,000.
I'm sure they wanted to reach more people, but yahoo and a few others marked ALL of the messages as spam due to massive increase in volume from this client.
Advice: Do things in a non greasy way, and while you may grow slower because of it, your users, and their email providers, will like you more for it.
Edit: I missed the transactional part here. Transactional emails are excluded from CAN-SPAM. There's a test to figure out which is which: http://www.the-dma.org/press/PrimaryPurposeFactSheet.pdf It's shitty UX regardless of whether it's a violation of law, IMO. Original: It's a violation of CAN-SPAM law to put unsubscribe behind a login process. Asking for a password violates the requirement that no additional PII ex…
Edit: I missed the transactional part here. Transactional emails are excluded from CAN-SPAM. There's a test to figure out which is which: http://www.the-dma.org/press/PrimaryPurposeFactSheet.pdf It's shitty UX regardless of whether it's a violation of law, IMO. Original: It's a violation of CAN-SPAM law to put unsubscribe behind a login process. Asking for a password violates the requirement that no additional PII ex…
Edit: I missed the transactional part here. Transactional emails are excluded from CAN-SPAM. There's a test to figure out which is which: http://www.the-dma.org/press/PrimaryPurposeFactSheet.pdf It's shitty UX regardless of whether it's a violation of law, IMO. Original: It's a violation of CAN-SPAM law to put unsubscribe behind a login process. Asking for a password violates the requirement that no additional PII ex…
I know this is true for mass marketing emails, but is it the same for transactional emails also?
Explained at http://business.ftc.gov/documents/bus61-can-spam-act-complia... and excerpt below:
A. What matters is the “primary purpose” of the message. To determine the primary purpose, remember that an email can contain three different types of information:
1. Commercial content – which advertises or promotes a commercial product or service, including content on a website operated for a commercial purpose;
2. Transactional or relationship content – which facilitates an already agreed-upon transaction or updates a customer about an ongoing transaction; and
3. Other content – which is neither commercial nor transactional or relationship.
If the message contains only commercial content, its primary purpose is commercial and it must comply with the requirements of CAM-SPAM. If it contains only transactional or relationship content, its primary purpose is transactional or relationship. In that case, it may not contain false or misleading routing information, but is otherwise exempt from most provisions of the CAN-SPAM Act.