Yes for legitimate companies, and it's legally required. In the US, CAN-SPAM obliges a sender to honour an opt-out within 10 business days, to keep the opt-out mechanism working for at least 30 days after sending, and — the part most people don't know — bars them from selling or transferring your address afterwards. For operators already ignoring the law, clicking unsubscribe achieves nothing and confirms your address is live. The skill is telling the two apart.
What the law actually requires
The FTC's compliance guide is specific. A commercial message must include a clear explanation of how to opt out, and:
- the opt-out mechanism must work for at least 30 days after the message was sent;
- the sender must honour the request within 10 business days;
- they can't charge you, demand any personal information beyond your email address, or make you do more than send a reply or visit a single page;
- once you've opted out, they may not sell or transfer your address, even as part of a mailing list;
- penalties reach up to $53,088 per individual email in violation.
That fourth point is genuinely useful and almost never mentioned. Unsubscribing doesn't just stop that sender — for a compliant company, it takes your address out of their onward-sharing pipeline as well.
The structural catch
A company does not need your consent before emailing you. It only has to stop once you ask. That single design choice explains most of what your inbox looks like — and it's why unsubscribing can work perfectly while your total volume keeps rising. You're playing defence against an unlimited number of senders, one at a time.
It also means unsubscribing only binds the sender you asked. If your address was already shared with forty other parties before you clicked, that's forty more unsubscribes ahead of you.
When not to click
The folklore that unsubscribing "confirms your address" is right for one category and wrong for the rest.
An operator running phishing, malware or purely fraudulent campaigns is not worried about a compliance guide. For them, an unsubscribe link is a liveness check: it confirms a human read the message. Addresses that show engagement are worth more and get resold into better lists.
Rule of thumb: if you recognise the company and can plausibly explain how they got your address, unsubscribe. If you've never heard of them, or the mail is obviously fraudulent, don't touch anything in it — mark it as spam instead.
How to tell them apart
| Signal | Likely legitimate | Don't click |
|---|---|---|
| You recognise the company | ✓ | |
| You can explain how they got your address | ✓ | |
| A valid physical postal address is in the footer | ✓ (the law requires it) | |
| Your mail client shows a one-click unsubscribe button | ✓ | |
| Sender domain doesn't match the brand | ✓ | |
| Subject line doesn't match the contents | ✓ (also illegal) | |
| Pharmaceuticals, crypto, gambling, adult | ✓ | |
| Unsubscribing asks you to log in or confirm personal details | ✓ (also illegal) |
Use the header button where you can
Many mail clients show an unsubscribe link at the top of the message, driven by a List-Unsubscribe header. Prefer it: it's handled by your mail provider rather than by loading the sender's page, so it doesn't confirm anything about you beyond the request itself.
Why it can feel like it doesn't work
- Ten business days is two weeks. Mail already queued still arrives.
- Sub-brands are separate senders. Opting out of one list doesn't cover the others.
- Your address was shared before you asked. The recipients of that share never received your opt-out.
- Transactional mail isn't covered. Receipts, shipping updates and account notices are exempt from most CAN-SPAM provisions and will keep arriving. That's by design.
- Some senders simply don't comply. Report those at ReportFraud.ftc.gov.
The limit worth understanding
Unsubscribing is reactive and it scales badly. It works — legitimately and legally — on one sender at a time, after they've already reached you, and it does nothing to reduce the number of organisations holding your address. Do it for every company you deal with and the total will still climb, because each new signup adds another.
The complementary move is to control the address instead of the message: give each company a different one, so an address that starts attracting mail you didn't ask for can simply be switched off — without a legal framework, a ten-day window, or the sender's cooperation. How that works.
Both together is the sensible position: unsubscribe from senders you recognise, and stop giving new companies the address everyone already has.
More: how to stop spam emails · less spam in Gmail · why the volume jumped