Ask once, in writing, using their unsubscribe mechanism — then escalate. In the US, CAN-SPAM gives you the right to opt out of commercial email, requires the sender to honour it within 10 business days, and bars them from selling or transferring your address afterwards. If they ignore you, report them to the FTC. And if the address you gave them is one you control, you can end it unilaterally without their cooperation at all.
Step 1 — Use the opt-out, and note the date
Use the unsubscribe link or the header button in your mail client. Write down when you did it, because the deadline runs from there.
What the sender is required to do, per the FTC's compliance guide: keep the opt-out mechanism working for at least 30 days after sending, honour your request within 10 business days, and not charge you or demand any personal information beyond your email address. They also may not make you do more than send a reply or visit a single page. Source: FTC, CAN-SPAM Act: A Compliance Guide for Business. Checked: 2026-08-19.
An opt-out form that demands your postal address, date of birth or a login is itself non-compliant.
Step 2 — Know what the opt-out covers
- It covers commercial messages — anything whose primary purpose is advertising or promotion. CAN-SPAM applies to all commercial email including business-to-business, not just bulk campaigns.
- It doesn't cover transactional mail. Receipts, shipping notices, warranty and safety information, account and membership changes are largely exempt. You generally want these.
- Sub-brands may be separate senders. Opting out of one list doesn't automatically cover the others.
- Being a customer doesn't waive it. Subscribers and members keep the right to opt out of marketing.
Step 3 — Escalate
If mail continues past 10 business days:
- Report to the FTC at ReportFraud.ftc.gov. Penalties run to up to $53,088 per individual email in violation, so this is not a toothless complaint.
- Email their privacy or legal contact directly, citing the date you opted out. Companies that ignore an unsubscribe form often act quickly when a named person receives a dated, specific complaint.
- If you're in the EU or UK, the GDPR gives you additional routes — a right to object to direct marketing, and a right to erasure — enforceable through your national data protection authority.
- Block the domain in the meantime so you stop seeing it while the process runs. How to block properly.
The option that needs nobody's cooperation
Every step above depends on the company doing something, or a regulator making them. There's one move that doesn't.
If you gave that company an address nothing else uses, you can switch it off. Mail to it stops being delivered — no ten-day window, no complaint, no escalation. With a service that rejects rather than silently discards, their mailing platform receives a hard bounce, which is itself a signal to suppress the address. What that actually does.
The catch is that it only works if you set it up beforehand. You can't retrofit it onto an address you already handed out — but you can make it true for every company from now on. How.
What not to bother with
- Asking how they got your address. Rarely produces a useful answer, and in most jurisdictions they're not obliged to give you one in a form you'd find satisfying.
- Replying angrily to the campaign address. Usually unmonitored, and it confirms a human reads the mail.
- Unsubscribing from senders you've never dealt with. Different situation entirely — that's a liveness check, not an opt-out. Why.