Live data from Hacker News

Hey developers, stop forcing me to login to unsubscribe

news.ycombinator.com

21–30 of 137 posts

Re: Hey developers, stop forcing me to login to unsubscribe

#22
post #18

Edit: I missed the transactional part here. Transactional emails are excluded from CAN-SPAM. There's a test to figure out which is which: http://www.the-dma.org/press/PrimaryPurposeFactSheet.pdf It's shitty UX regardless of whether it's a violation of law, IMO. Original: It's a violation of CAN-SPAM law to put unsubscribe behind a login process. Asking for a password violates the requirement that no additional PII ex…

I know this is true for mass marketing emails, but is it the same for transactional emails also?

I read the thread too fast. Transactional emails are excluded under CAN-SPAM. But there are many times that "transactional emails" going out contain marketing/commercial content. There's a test for those emails to see if they pass: http://www.the-dma.org/press/PrimaryPurposeFactSheet.pdf

Many "transactional" emails probably fail the above test. It's shitty UX to make you login to opt-out, even if it's not against the law.

Re: Hey developers, stop forcing me to login to unsubscribe

#23
post #20
post #18

Earlier quoted context omitted.

I know this is true for mass marketing emails, but is it the same for transactional emails also?

Transactional emails are generally exempt. Explained at http://business.ftc.gov/documents/bus61-can-spam-act-complia... and excerpt below: A. What matters is the “primary purpose” of the message. To determine the primary purpose, remember that an email can contain three different types of information: 1. Commercial content – which advertises or promotes a commercial product or service, including content on a website…

You're right—read the thread too fast. What's more interesting to me, is how many of these so called "transactional" emails actually pass the test?

More on that here: http://www.the-dma.org/press/PrimaryPurposeFactSheet.pdf

Re: Hey developers, stop forcing me to login to unsubscribe

#24
Hear, hear. If you're worried about legit customers getting unsubscribed against their will (because that is TOTALLY a significant occurrence...), you can have a dual approach. Unsubscribing without authentication sends one final message which has an undo link; unsubscribing while authenticated shows a confirmation on the site instead of the inbox.

I know, the "Here's an email to confirm that you hate our emails" message isn't anyone's favorite... but if it helps companies improve their unsubscription mechanisms, I can let it slide.

Re: Hey developers, stop forcing me to login to unsubscribe

#25
I was recently bitten by the Freelancer/vWorker acquisition in this regard! I became "vw9916640" and had–to my knowledge–no password. This did not stop their unsubscribe form from prompting for the aforementioned unknown/nonexistent password.

I'm still getting e-mails from them to this day.

Re: Hey developers, stop forcing me to login to unsubscribe

#26
post #7

On one hand, I do agree that it is very annoying. However, I can kind of understand. There may be a way around this, but if no session was required, then couldn't someone just make a bunch of GET requests to the unsubscribe url for each user id and unsubscribe the entire user base?

Just use CSRF tokens.

Yeah, I don't know why I didn't think of that. In that case, there really isn't any justification.

Re: Hey developers, stop forcing me to login to unsubscribe

#28
This is really annoying. What I find more annoying is response like "We will process your request within 30 business days." (and after that period receive another spam). What could possibly take 30 business days to unsubscribe email? This is evil.

I would also like to see some sort of standard - like email header with link, that would unsubscribe you. Outlook/thunderbird/etc could just show button (probably next to "mark as spam" :)) and you couldjust click and be done. I think google tried something like this, but I've never heard of anyone else.

Re: Hey developers, stop forcing me to login to unsubscribe

#29
It's also a violation of the CAN-SPAM act: http://business.ftc.gov/documents/bus61-can-spam-act-complia...

If I try to unsubscribe from an email list and am presented with a login prompt, I report the sender as spam without an instant of hesitation or regret.

Post reply on HN