Unsubscribe handling for cold email: CAN-SPAM, GDPR, and the operator playbook
Unsubscribe is not optional. Here is the link, the header, and the suppression list - and the legal layer underneath.
Rejwan Nirob·Jan 4, 2026·6 min readCold email is regulated. The exact rules depend on jurisdiction, but every major framework requires the same basic mechanism - recipients must be able to stop receiving mail. The mechanism is technical (an unsubscribe link, a List-Unsubscribe header) and operational (an honoured suppression list).
CAN-SPAM (US)
Required: a clear unsubscribe mechanism, honoured within 10 business days, with a working physical postal address in the email. Cold email is permitted under CAN-SPAM with these conditions met.
GDPR (EU)
Stricter. Cold email to EU recipients typically requires legitimate interest as the legal basis, with documented justification. Easier path is targeting B2B contacts with explicit job-relevant outreach. Personal-data minimisation applies - store the list, the purpose, and the suppression separately.
The technical layer
- List-Unsubscribe header on every cold email - Gmail and Outlook surface a one-click unsubscribe button when present
- List-Unsubscribe-Post: List-Unsubscribe=One-Click - required for the Gmail one-click flow
- Unsubscribe link in the visible body - required by CAN-SPAM
- Suppression list - every unsubscribe must be persisted and applied to all future campaigns
What sending tools handle automatically
Smartlead, Instantly, and Lemlist all add the List-Unsubscribe header automatically and maintain per-account suppression lists. Inboxlee provisions infrastructure - the unsubscribe layer lives in your sending tool. Both must be configured correctly for compliance.
Inboxlee does not write or send your campaigns - the unsubscribe layer is your sending tool's job. The infrastructure (DNS, mailbox provisioning, deliverability monitoring) is ours.
Frequently asked
Is cold email legal under CAN-SPAM?
Yes, with three conditions: a clear unsubscribe mechanism that is honoured within 10 business days, a working physical postal address visible in the email, and accurate sender identification (no forged From line). Cold email is permitted under CAN-SPAM provided these are met. Failure to honour unsubscribes is the most common violation.
Can I send cold email to EU recipients under GDPR?
Yes, but stricter than CAN-SPAM. You need a documented legitimate-interest justification for each recipient, B2B-only with job-relevant outreach is the easiest path, and personal-data minimisation applies (store list, purpose, and suppression separately). Unsubscribe requests must be honoured immediately, not within 10 business days.
What is List-Unsubscribe vs the unsubscribe link in the email body?
Both are required for compliance with modern Gmail/Yahoo rules at scale. List-Unsubscribe is the header that lets Gmail/Yahoo render a one-tap unsubscribe button at the top of the message. The body link is what CAN-SPAM technically requires - a visible unsubscribe inside the message. Smartlead, Instantly, Lemlist, and Apollo all add both automatically.
Who handles unsubscribe processing - Inboxlee or my sending tool?
Your sending tool. Inboxlee provisions infrastructure (DNS, mailbox, monitoring); Smartlead/Instantly/Lemlist/Apollo handle campaign-level unsubscribe processing and maintain the per-account suppression list. Both must be configured correctly: Inboxlee for clean deliverability, your sending tool for compliance.
What happens if I do not honour cold-email unsubscribes?
Three escalating consequences. Sender reputation drops because the unsubscribed recipients increasingly mark the mail as spam. Legal liability under CAN-SPAM (up to $50,000 per email in the US) and GDPR (up to 4% of global revenue in the EU). Future deliverability damage because mailbox providers track unsubscribe-vs-spam ratios as a sender quality signal.