Unsubscribing Takes Ten Business Days Because a Law Says It May

Somewhere near the bottom of the email, under the unsubscribe link, in small gray type: please allow up to ten business days for your request to be processed. We wanted to know what takes ten days. We now know, and it is worse than a slow computer, because there is no computer in it at all.

The ten days is a number in a law. Congress wrote it into the CAN-SPAM Act in December 2003, the one agency with the power to change it has twice considered doing so and twice left it alone, and nothing in the statute obliges anyone to use a single one of them. A company that takes the full ten is doing exactly what the law allows, which is a different sentence from doing what it requires.

You know the sequence. You gave a shop your address for ten per cent off a thing you were buying anyway, and you have done this before, and you will do it again in November. It sent a welcome, then a reminder, then a note that the thing you bought is still available, and on the fourth you found the link.

The page thanked you and then it said ten business days, and you did the arithmetic on a fortnight of further reminders and closed the tab. It is the same footer on all of them, and we have now read where it comes from.

Where the number comes from

The Act is Public Law 108-187 (opens in a new tab), in force since 1 January 2004, and the relevant line is section 5(a)(4): once you ask to stop, it is unlawful for the sender to mail you “more than 10 business days after the receipt of such request”. That is the whole of it. There is no minimum and no “as soon as practicable”. Ten business days is the point at which sending becomes unlawful; everything before it is a choice.

Two other clauses make the footer look even less like engineering. The unsubscribe link has to keep working for at least 30 days after the message is sent, and the FTC’s rule (opens in a new tab) forbids charging you, asking for anything beyond your email address, or making you do anything beyond sending a reply or visiting one web page. The law has thought hard about the mechanism and put a ceiling on the delay. The delay itself it left to the sender, and the sender read the ceiling as a floor.

We went looking for why ten. The Senate committee report (opens in a new tab) on the bill, from July 2003, restates the provision — the sender “must cease the transmission of UCE to that recipient within 10 business days” — and gives no reason for the figure. The section has not been amended since. Before you write in with the reason: we would like to hear it too, because the people who wrote it did not leave one.

The regulator tried to shorten it

Congress did leave a door. Section 5(c) tells the Federal Trade Commission to modify the ten days “if the Commission determines that a different period would be more reasonable”, weighing the purposes of the Act, the interests of recipients and the burdens on lawful senders. In March 2004 the FTC asked whether ten was reasonable, and 13,517 comments (opens in a new tab) arrived, which is what happens when you ask the internet about spam.

In May 2005 it proposed three. The notice (opens in a new tab) is unusually plain about why: the proposed rule would cut the period to three business days because the record showed “current technology allows for processing such opt-out requests more expeditiously than the current ten-business-day time frame.” Elsewhere it observed that “many commenters already are able to process opt-out requests virtually instantaneously”. That was 2005, and the agency responsible for commercial email had established, in writing, that the delay was not technical, and proposed to take seven business days off it.

Responses split the way you would expect: industry, including small businesses, wanted ten or longer, and individual consumers wanted less. Of the 3,818 people who answered the FTC’s web questionnaire, nearly half thought ten was fine, 38 per cent wanted it shorter, and 16 per cent wanted it longer and would presumably like ten more days to explain why.

Why it stayed at ten

The final rule (opens in a new tab) came in May 2008, three years after the proposal, and left the number alone. About a hundred commenters had addressed the point, and “the vast majority — over 85 percent — opposed reducing the time frame to less than ten business days.” We read both notices in full, in the two-column Federal Register typeface, which is the closest thing to a hair shirt the government prints, and we have strong views on footnote 215.

Their reasons are the part we regret. Experian described large corporations with legacy databases that pull their suppression lists “a week in advance”, the “use of hard-copy media — such as CDs — to transmit the files via the postal service”, and small businesses on low-bandwidth connections. The cable industry’s trade body said an operator could log your request in its own database in one or two days, but its third-party marketing vendor “may take up to 8-10 business days to complete the processing.”

Sprint said making its systems faster would take “at least 30,000 man hours, or in excess of $2 million.” A human-resources association argued it was unreasonable to expect “a single paid staff director to check for, and handle, opt-out requests several times per week.” Somebody was posting a CD, somebody’s vendor needed eight to ten days, a telecoms company priced the fix at two million dollars, and on that record the regulator decided you could fucking wait.

Some commenters asked for longer — 30 or 31 days, on the ground that telemarketers get 31 to process new Do Not Call listings — and to its credit the Commission refused that as well, finding that senders “are not unduly burdened by the ten-business-day grace period for honoring opt-out requests established by Congress.” Then it declined to shorten it, because three days could burden legitimate marketers, small ones especially, and “would not necessarily advance the privacy interests of consumers.” Nobody had shown the harm, so the ten stayed. That is the whole logic, and it is airtight in the way an empty room is.

The FTC’s own name for the period, all through the rule, is a “grace period”. That is the honest term. It is a period of grace for the sender, and grace is something you extend, not something you need.

What senders did with it

The finding that makes the footer a confession is a table the FTC produced itself. Its staff signed three fresh email accounts up to a hundred top online retailers, waited six weeks, and in January 2005 opted out and watched. Of the 83 that had mailed, 89 per cent honoured all three requests (opens in a new tab). The other numbers are the useful ones: 75 per cent sent nothing further at all, 14 per cent sent something inside the ten business days, and 11 per cent were still sending after it, which is the unlawful part.

So a year into the Act, three in four of the country’s top online retailers stopped on the day. The window was being used by one in seven and overrun by one in nine. The FTC cited the compliance figure in 2008 as proof that the ten days was feasible, which it was; the same table shows it was, from the start, a description of a minority, quoted to everyone.

They looked again in 2019

In June 2017 the FTC opened a review of the rule and asked, among other things, whether it should shorten the time period for processing opt-out requests (opens in a new tab). Ninety-two comments came back, and on the number they split six and six.

The six against cited the burden on small businesses that still process requests by hand. The six for thought ten “unnecessarily lengthy” given the automation available to anyone who wanted it. The Commission kept the rule (opens in a new tab) without modification, five votes to none, because nobody had shown how ten days hurt anyone. In 2019 the case for keeping ten was that some businesses still unsubscribe people by hand, which is a case for those businesses to stop, not for the rest of us to wait.

The mailbox has its own rules now

Ten days is the law. Before you write in to say so: it is, and it stopped being the practice for anyone sending at scale some time ago, because the two companies that own the inbox set their own number. One-click unsubscribe has been a published standard, RFC 8058 (opens in a new tab), since January 2017.

In October 2023 Google announced (opens in a new tab) that from February 2024 anyone sending more than 5,000 messages a day to Gmail would have to offer it and “process unsubscription requests within two days”. Yahoo’s sender rules, enforced from the same month, say “Honor unsubscribes within 2 days” (opens in a new tab).

The regulator that spent three years choosing between three and ten was overtaken by two firms that could simply decline the mail. Two days is not a law and nobody voted on it, and it is the number a sender in volume now has to meet, which tells you what the ten was ever worth as a constraint. The footer is now doubly odd: a company sending in volume that takes ten days is inside the statute and outside the inbox.

Elsewhere, and the penalty

Ten is not a natural constant. Canada copied it (opens in a new tab) and added a conscience — “without delay, and in any event no later than 10 business days”. Australia set five.

The EU’s GDPR gives you the right to object to marketing “at any time” and sets no number; the UK’s regulator says “act promptly” (opens in a new tab) and leaves it there. The number is wherever a legislature put it, which is how you can tell it is not a property of email.

The penalty, for what it is worth, is for going past ten, never for using nine. The FTC’s guide puts it at up to $53,088 per email (opens in a new tab), and the largest penalty it has ever obtained under the Act is $2.95 million, from a security-camera company that sent more than 30 million commercial emails (opens in a new tab) in three years and, among other failings, did not honour requests to stop. That is the record for ignoring you outright. There is no case at all against a company for taking the full window, because the full window is the law, and the law has been read, closely, by the people who wrote the footer.

We should be fair to the single paid staff director at the small association, who cannot check the inbox several times a week and said so, in writing, to a federal agency. That person is not the one sending you a fourth reminder about the thing you already bought. The company doing that has a marketing platform, a suppression list that updates itself and a legal department that has read section 5(a)(4) as carefully as we just did — and it chose the gray text anyway.

The sentence under the link is the most carefully written line in the email, and it is accurate. It says how long they are allowed. It has never once said how long they need.