Cold Email Unsubscribe and Do-Not-Contact Law: UK, US, France and UAE, and How to Build a Suppression List

What does the law require when someone says stop?

Three points the table hides. First, the US deadline is a ceiling, not a target. CAN-SPAM also bars you from selling, leasing or transferring an opted-out address (7704(a)(4)); the FTC guide allows a transfer to a company you hired to help you comply. Second, UK GDPR's right to object to direct marketing is not subject to a balancing test once it is raised, which means a polite "please stop" reply is a legal objection even if it never touches your unsubscribe link. Third, the TDRA policy is addressed to telecoms licensees. We read it to understand the UAE standard, but we cannot tell you from the text how it reaches a business sending its own cold email. Put that question to UAE counsel.

What do Gmail and Yahoo add on top of the law?

Mailbox providers set the practical deadline, because they can block you faster than a regulator can fine you. Google's sender guidelines require marketing and subscribed messages from senders of 5,000 or more messages a day to Gmail accounts to support one-click unsubscribe, with a clearly visible unsubscribe link in the body. Google's FAQ says mailto links and plain web-page links do not satisfy the one-click requirement and recommends honouring unsubscribe requests within 48 hours. Yahoo asks bulk senders for a functioning List-Unsubscribe header with one-click support and to process unsubscribes within 2 days; Yahoo's page says a mailto is acceptable, so the two providers do not agree on that detail.

One-click unsubscribe is defined in RFC 8058. The message carries a List-Unsubscribe header with one HTTPS link and a List-Unsubscribe-Post header with the value List-Unsubscribe=One-Click. The receiving mail provider sends an HTTPS POST to that link, so your server must accept a POST without a login or cookie and must not answer with a redirect. The message also needs a valid DKIM signature covering both headers. Our post on bulk sender rules covers the rest of the authentication setup.

How do you build a suppression list that actually holds?

This section is practice, not law. The law tells you what must stop. It does not tell you how to make sure nothing starts again from a different inbox, a different campaign or a re-imported spreadsheet. Those are the places an opt-out can quietly fail.

1. One list for the whole workspace. A suppression entry applies to every sending inbox and every campaign, not to the campaign the person replied to. Two inboxes emailing the same person after a stop request is an easy failure to build in by accident.
2. Normalise before you compare. Lowercase the address, trim spaces, and decide how you treat plus-addressing (name+tag@) and dots. Store the normalised form and check it at import and again at send time.
3. Check at send time, not just at import. A person can opt out between the day a list is loaded and the day step three of a sequence goes out. The check belongs in the sending step.
4. Catch replies, not just clicks. People write "stop", "remove me" or "not interested, don't email again". Detect those replies, suppress, and have a person review the borderline ones. Treat bounces and spam complaints as suppressions as well.
5. Offer a domain-level block as a choice. If someone at a company says "don't email anyone here", you can add the domain. Do not do it automatically: one person's objection is theirs, and blocking a whole company loses colleagues who never asked to be removed.
6. Keep the record, minimise the data. To honour an opt-out you must remember it, which means keeping at least the address. Keep that and the date, source and reason, and nothing else. Ask your adviser whether to store a hash or the plain address.
7. Re-import safety. Run every new list against the suppression list before it enters any sequence. A person who opted out and comes back on a purchased list stays suppressed unless they opt in again themselves.

What is MAJ Leads building here?

We are building cold email into MAJ Leads now. The design above is the one we are building to: a workspace-wide suppression list, a check at send time, reply detection, and an unsubscribe route in every message. It is a plan, not a report from live sending. What exists today is on how it works. For the phone side of the same problem in the UAE, our guide to your don't-call list vs the DNCR covers how an internal list and the national register fit together. For where the consent rules start, see UK cold email rules and CAN-SPAM for cold email.