Last reviewed:
Translated from German; if the versions differ, the German version applies.
Not legal advice: Legal content on this page appears only as verbatim quotations from statutes, court rulings or authority papers, with their source; quotations from German texts are our working translations. We do not assess them ourselves, and no lawyer has reviewed this page. It is no substitute for legal advice in your individual case.
Unsubscribing from a newsletter
Unsubscribing from a newsletter is dealt with by competition law (Section 7 of the UWG, the German Act against Unfair Competition, Gesetz gegen den unlauteren Wettbewerb), data protection law (Art. 7 and 21 of the EU General Data Protection Regulation, GDPR) and the guidance of the German data protection authorities; on the technical side, the rules of the large mailbox providers come on top. This page quotes the legal sources verbatim and describes the technology. Anyone who makes unsubscribing difficult also tends to get more spam reports – and these harm the deliverability of every subsequent mailing.
What the laws say
Quotations from German laws, court rulings and authority papers are our working translations; only the German wording is authoritative (see the German version of this page). GDPR quotations follow the official English text.
Competition law (UWG). Section 7(2) no. 3 UWG reads: “An unacceptable nuisance is always to be assumed […] in the case of advertising with a message, […] in which there is no valid address to which the recipient can send a request to stop such messages without incurring any costs other than the transmission costs at the basic rates” (Section 7(2) no. 3(c) UWG, our translation). In Section 7(3) UWG (existing customers), number 4 reads: “the customer is clearly and distinctly informed, when the address is collected and each time it is used, that they may object to the use at any time without incurring any costs other than the transmission costs at the basic rates” (Section 7(3) no. 4 UWG, our translation).
Data protection law (GDPR). On withdrawal of consent:
“The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.” — Art. 7(3) GDPR
On objection to direct marketing:
“Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.” — Art. 21(2) GDPR
“Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.” — Art. 21(3) GDPR
“At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.” — Art. 21(4) GDPR
The German Data Protection Conference (Datenschutzkonferenz, DSK) writes in its guidance on direct marketing: “For reasons of verifiability, it is advisable to include the notice of the right to object in every advertising mailing.” (our translation; section 5.2, p. 18)
What the authorities write about the design
“It should be possible to unsubscribe from email advertising with one click if possible (clicking the unsubscribe link in the promotional email) without additional hurdles or obstacles. In particular, questions about the reason for unsubscribing must not be mandatory. Even where an unsubscribe link exists, it must be borne in mind that an objection to advertising can also be declared in other ways, for example by a reply email.” (our translation) — DSK guidance on direct marketing (February 2022), section 5.3, p. 19
On sender addresses that cannot be replied to:
“If the controller uses ‘noreply’ addresses to send promotional emails, it must pay particular attention to giving data subjects a simple and quick way of objecting that compensates for the fact that with ‘no-reply’ addresses a direct reply to the sender address is not possible and one form of objecting to advertising is thus cut off. Against this background, the use of ‘no-reply’ addresses is a variant which – depending on the specific design – carries the risk of making it more difficult for data subjects to exercise their rights, contrary to Art. 12(2) GDPR. In order to comply with the facilitation requirement under Art. 12(2) sentence 1 GDPR, it is advisable in this case to set a ‘reply-to’ address.” (our translation) — DSK guidance on direct marketing (February 2022), section 5.3, p. 19
How quickly unsubscribing takes effect
“If the objection is made via a link in a promotional email or via a setting in the customer portal, the personal data are no longer processed pursuant to Art. 21(3) GDPR. For purely electronically sent advertising, there is no reason in these cases to deviate from the wording of the law, according to which the objection must be complied with immediately.” (our translation) — DSK guidance on direct marketing (February 2022), section 5.4, p. 20
The mailbox providers name their own deadlines in their guidelines: Google recommends processing unsubscribes within 48 hours; Yahoo requires them to be honoured within 2 days. These deadlines are the providers’ rules for delivery, not legal texts.
List-Unsubscribe: unsubscribing in the email header
In addition to the link in the text, there is a technical unsubscribe in the email header. Mail programs show it, for example, as “Unsubscribe” next to the sender.
The List-Unsubscribe header comes from RFC 2369 (1998). It contains one or more addresses in angle brackets – an email address (mailto:) or a web address:
List-Unsubscribe: <https://example.com/unsubscribe?id=…>, <mailto:unsubscribe@example.com>One-click unsubscribe (RFC 8058) adds a second header:
List-Unsubscribe-Post: List-Unsubscribe=One-ClickThe mail program then calls the web address with an HTTPS POST request, and the unsubscribe must take effect without any further step. RFC 8058 requires an HTTPS address and a valid DKIM signature that covers both header fields. The background: anti-spam software often fetches addresses in header fields automatically; a simple GET request must therefore not unsubscribe on its own, otherwise recipients would be removed unintentionally.
Gmail requires one-click unsubscribe from bulk senders for marketing and subscribed messages, plus a clearly visible unsubscribe link in the body; according to Google’s FAQ, a mailto link or an unsubscribe page alone is not sufficient for this. Yahoo requires a working List-Unsubscribe header and strongly recommends the one-click method. Details: Requirements of the mailbox providers.
After unsubscribing
On suppression lists in which objections are recorded (advertising suppression files), the DSK writes:
“Such advertising suppression files may be permissible on the basis of Art. 21(3), Art. 6(1) subpara. 1(f) GDPR in conjunction with Art. 17(3)(b) GDPR for taking into account data subjects’ objections to advertising in order to ensure compliance with the legal claim asserted. However, this requires processing for advertising purposes under Art. 6(1) subpara. 1(f) GDPR. If use for advertising is only permissible on the basis of consent, the controller must in any case ensure that consent exists in every individual case.” (our translation) — DSK guidance on direct marketing (February 2022), section 5.1, p. 17
On proof of the earlier consent:
“However, even after a withdrawal and the deletion of the personal data from the advertising database, the controller must be able to prove the consent. […] This processing of the consent, which continues even after withdrawal, must already be pointed out when the data are collected. […] Proof of consent must be possible both vis-à-vis the supervisory authority and vis-à-vis the data subject within the standard limitation periods for claims under administrative-offence and civil law (3 years, Section 31(2) no. 1 OWiG and Section 195 BGB respectively) […].” (our translation) — DSK guidance on direct marketing (February 2022), section 3.7, p. 14
Whether a confirmation of the unsubscribe that also contains an offer is a further promotional email within the meaning of Section 7 UWG is not expressly answered by the law or by the authority papers quoted here.
Technical checklist
Technology under RFC 8058 and the mailbox providers’ rules only, no legal review.
-
List-Unsubscribewith an HTTPS address in the header (RFC 2369, RFC 8058) -
List-Unsubscribe-Post: List-Unsubscribe=One-Clickin the header, both header fields covered by the DKIM signature (RFC 8058) - The address only unsubscribes on a POST request, not on a mere call (GET)
- Clearly visible unsubscribe link in the body (Gmail, bulk senders)
- Unsubscribes honoured within the providers’ deadlines (Google: 48 hours recommended, Yahoo: 2 days)