Is one-click unsubscribe a law?

No, one-click unsubscribe is not a law in itself. RFC 8058 is a technical standard, and Gmail's one-click rule is a requirement Google places on senders. Laws vary by jurisdiction and message type: in the United States, the FTC says the CAN-SPAM Act requires commercial email to offer a clear way to opt out, without making RFC 8058 headers a legal requirement.

Why should I not click unsubscribe?

The one good reason to avoid an unsubscribe link is a message you cannot verify, because the link may belong to a phishing attempt rather than a real list. The FTC advises consumers not to engage with unexpected phishing messages. For mail you knowingly subscribed to, unsubscribing is the right way to stop it.

Is an unsubscribe facility mandatory?

Yes in many cases, though the exact obligation depends on the mailbox provider, the message type, your sending volume, and the law where you send. Gmail requires one-click unsubscribe for qualifying bulk marketing and subscribed mail. Separately, United States commercial email must offer a clear opt-out method under the CAN-SPAM Act.

Is it illegal to not have an unsubscribe option?

It can be, depending on the jurisdiction and the type of message. In the United States, commercial email covered by the CAN-SPAM Act must include a clear opt-out mechanism. Rules elsewhere differ, so take legal advice for the jurisdictions and message categories your organization sends to.

Is one-click unsubscribe mandatory?

Yes, one-click unsubscribe is mandatory for marketing and subscribed messages sent by bulk senders to personal Gmail accounts. Gmail defines a bulk sender as one that sends more than 5,000 messages per day to Gmail accounts, and its requirements began on February 1, 2024. It is not a universal requirement for every email or every mailbox provider, and transactional messages are excluded from Gmail's one-click rule.

At a glance

Quick takeaways

Gmail requires qualifying bulk senders to support one-click unsubscribe for marketing and subscribed messages.
Gmail's bulk-sender threshold is more than 5,000 messages per day to Gmail accounts.
Transactional messages such as password resets, purchase receipts, and one-time passwords are excluded from Gmail's one-click unsubscribe requirement.
RFC 8058 defines the HTTPS header and POST mechanism used for one-click unsubscribe.
A visible unsubscribe link in the message body does not replace Gmail's required one-click headers.
One-click unsubscribe is a mailbox-provider requirement, not a universal legal rule for all messages and jurisdictions.

Who is affected?

Gmail's Email sender guidelines apply the one-click unsubscribe requirement to senders that send more than 5,000 messages per day to personal Gmail accounts. The affected traffic is marketing and subscribed mail. Gmail's sender-guidelines FAQ says transactional messages are excluded. Its examples include password reset messages, reservation confirmations, form-submission confirmations, purchase receipts, and one-time passwords.

The requirement is based on the traffic sent to Gmail accounts, not solely on a sender's total database size. A sender that is below the threshold today can cross it during a campaign, so teams should classify message streams before a volume increase.

The sender or its email service provider must add the headers and operate the HTTPS endpoint. The mailbox provider decides whether to display an unsubscribe control to its users. Implementing the headers does not require Gmail to render a button for every message.

For wider context, the sender requirements guide tracks mailbox-provider requirements that sit alongside authentication, alignment, and spam-rate controls. These requirements affect email deliverability, but they do not guarantee inbox placement.

What are the requirements?

The message must support RFC 8058 one-click unsubscribe

Gmail says qualifying bulk senders' marketing and subscribed messages must support one-click unsubscribe. Its implementation guidance requires both headers below, with an HTTPS URL in List-Unsubscribe.

Technical exampletext

List-Unsubscribe: <https://unsubscribe.yourdomain.com/list/opaque-token>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The URL and token are illustrative only. Generate the actual recipient-specific endpoint in the sending platform or subscription system. Do not publish real recipient identifiers or reusable unsubscribe tokens.

RFC 8058 is an IETF Standards Track RFC published in January 2017. It defines the mechanism that signals one-click functionality for list email. The RFC requires a List-Unsubscribe field containing an HTTPS URI and a List-Unsubscribe-Post field with the List-Unsubscribe=One-Click value.

Decision checklist showing when Gmail one-click unsubscribe applies and the required headers — Source: Palisade.

The unsubscribe endpoint must process the POST directly

Gmail documents the one-click request as an HTTP POST with the following body:

Technical exampletext

List-Unsubscribe=One-Click

RFC 8058 says the sender MUST NOT return an HTTPS redirect in response to the one-click POST. The endpoint cannot rely on a browser session, login, cookie, preference form, or a confirmation page to complete the removal.

A normal visible unsubscribe link can still take a recipient to a preference center. That body link has a different role. Gmail's FAQ says a mailto link or a web unsubscribe link by itself does not meet its one-click requirement.

The message needs a visible body unsubscribe link too

Gmail's bulk-sender guidelines require marketing and subscribed messages to support one-click unsubscribe and include a clearly visible unsubscribe link in the message body. The two controls are not substitutes for each other.

The header-based path lets a mailbox provider request removal without a browser navigation. The body link gives the recipient a direct, visible route to unsubscribe or manage preferences. Keep the body link usable even when the mailbox interface does not display an unsubscribe control.

The headers must be covered by a valid DKIM signature

RFC 8058 requires at least one valid DKIM signature to cover both List-Unsubscribe and List-Unsubscribe-Post. A message can have a passing DKIM status while still failing this specific condition if its signed-header list does not include both fields.

Inspect the delivered message headers. Check the h= value in the valid DKIM signature and verify that both one-click fields appear in it. A sending platform's authentication status is not proof that the production message included and signed the required unsubscribe headers.

When does the requirement take effect?

Gmail's general sender requirements, including the bulk-sender requirements, took effect on February 1, 2024. Gmail's FAQ says senders that already included an unsubscribe link had until June 1, 2024 to implement one-click unsubscribe for commercial and promotional messages.

Gmail has also stated that, starting in November 2025, it was ramping up enforcement for traffic that does not meet its sender requirements. Its current guidance says missing one-click unsubscribe can make qualifying bulk senders ineligible for delivery mitigations. Gmail does not say that every individual message missing one-click unsubscribe is automatically rejected or marked as spam.

RFC 8058 itself has no bulk-sender threshold or enforcement date. It defines the protocol. Gmail defines when qualifying senders must use it.

How do I implement the requirement?

1. Classify the sending stream

Separate marketing and subscribed traffic from transactional traffic. Identify every platform, subdomain, and From address that sends covered mail to Gmail recipients.

Do not classify a message as transactional only because it contains an account notice. If it also promotes products, newsletters, or optional campaigns, review it against Gmail's subscription-message guidance.

2. Create a recipient-specific HTTPS endpoint

Generate an opaque URL that lets the subscription system identify the recipient and mailing list without requiring a login. The endpoint should process an already-unsubscribed recipient safely, because a valid request may be repeated.

Do not use a token that exposes a plain email address in the URL. Limit logging of the complete URL because it can contain recipient-linked data.

3. Add the two headers before DKIM signing

Configure the sending platform to add List-Unsubscribe and List-Unsubscribe-Post to every covered message before DKIM signing occurs. Confirm that the DKIM signer includes both headers in its signed-header list.

If a third-party platform cannot add these headers or cannot sign them correctly, use that provider's documented one-click unsubscribe feature or raise the gap with its support team.

4. Keep the body unsubscribe link visible

Add a clearly visible unsubscribe link in the HTML and text versions of covered messages. The link may lead to a preference center, but it cannot replace the RFC 8058 header-based action.

5. Process the POST without browser context

Accept the List-Unsubscribe=One-Click request at the HTTPS endpoint and update the suppression state used by the relevant sending list. Return a direct response rather than redirecting the request to a web page.

Do not test a one-click endpoint with a production recipient unless the recipient can safely be suppressed. Use a controlled test address and verify which list the request removes it from.

How do I validate compliance?

Validate the implementation at four layers.

DNS: Confirm the sending domain's public authentication records resolve from the authoritative DNS service and a public resolver. DNS alone does not prove that the application added one-click headers.
Vendor: Check the sending platform's current authentication and unsubscribe configuration. A green vendor status does not prove the headers appeared on a delivered production message.
Message: Send a covered message through the exact production path to a controlled Gmail mailbox. Inspect the raw headers for List-Unsubscribe, List-Unsubscribe-Post, and a valid DKIM signature whose h= list covers both fields.
DMARC: Review aggregate-report data after traffic accumulates to confirm the production sources and aligned authentication results. One-click unsubscribe is separate from DMARC authentication, but the same sending inventory helps find platforms that were missed.

Test the endpoint with the RFC 8058 POST body, then verify that the recipient is suppressed in the system that controls the relevant list. Repeat the request to confirm that it does not create duplicate work. Test that the endpoint does not require cookies, HTTP authentication, or a redirect.

The Gmail one-click unsubscribe requirements article covers the Gmail-specific implementation context. An email security score can check public sender-security posture, but it cannot inspect a recipient-specific unsubscribe endpoint, a delivered message's signed headers, or Gmail's private delivery decisions.

Check the current sender requirement for your traffic

Use the sender requirements guide to compare the mailbox-provider rules with your actual message type and Gmail sending volume. One-click unsubscribe is mandatory only within the provider and traffic scope that requires it.

That guide cannot prove that a particular production message contained valid headers, that an unsubscribe endpoint processed a request, or that Gmail will display an unsubscribe control.

Evidence