Sales Loves MarketingTo opt out means to take an action to stop being included in something, such as clicking "unsubscribe" at the bottom of a marketing email. In an opt-out system, people are in by default and have to act to leave. In an opt-in system, people are out by default and have to act to join.
Where do you see opt-outs in marketing?
- Email: the unsubscribe link in every marketing email.
- Data sharing: "Do Not Sell or Share My Personal Information" links on websites of companies covered by California's privacy law.
- Tracking and cookies: settings that let people turn off personalised ads or analytics.
What is the difference between opt-in and opt-out?
| Opt-in | Opt-out | |
|---|---|---|
| Default | Not included | Included |
| Who acts | The person, to join | The person, to leave |
| Example | Ticking an empty box to get a newsletter | Clicking unsubscribe after being added to a list |
| Typical rule set | EU and UK consent rules | US CAN-SPAM Act |
What do the rules require?
This is a short overview, not legal advice.
United States (CAN-SPAM Act). You don't need consent before sending most commercial email, and the law applies to B2B email too. But every message must clearly explain how to opt out. You must honour opt-outs within 10 business days, keep the opt-out method working for at least 30 days after sending, and you can't charge a fee or ask for more than an email address. You also can't sell or pass on the addresses of people who opted out.
European Union (GDPR). Where you rely on consent, it must be an active choice. The European Data Protection Board says pre-ticked boxes and opt-out constructions are not valid consent. People can withdraw consent at any time, and it must be as easy to withdraw as to give. People also have the right to object to direct marketing at any time, and you must then stop using their data for it.
United Kingdom. Email marketing to individuals generally needs consent, or the "soft opt-in" for existing customers, which requires an opt-out in every message. Marketing to corporate addresses doesn't need consent, but you must identify yourself and give a valid address for opting out, and the ICO advises honouring those requests.
California (CCPA). Consumers can tell covered businesses to stop selling or sharing their personal information. Those businesses must offer a "Do Not Sell or Share My Personal Information" link and honour browser opt-out signals such as Global Privacy Control.
Mailbox providers. Gmail requires bulk senders to support one-click unsubscribe on marketing messages.
Best practices for email opt-outs
- Put a clear unsubscribe link in every marketing email.
- Make it one click. Don't make people log in.
- Offer a preference centre, so people can choose fewer emails instead of none.
- Process opt-outs quickly and sync them to every tool that sends email.
- Keep a suppression list, so people who opted out aren't re-imported later.
A hidden unsubscribe link doesn't keep people subscribed. It pushes them to the spam button, which harms your deliverability.
Related terms
Frequently asked questions
What is the difference between opt-in and opt-out?
Opt-in means people are left out until they actively agree, for example by ticking an empty box. Opt-out means people are included by default and must act to leave, for example by clicking unsubscribe. EU and UK rules lean on opt-in for marketing to individuals, while the US CAN-SPAM Act is built around opt-out.
How fast must you process an unsubscribe request?
Under the US CAN-SPAM Act, within 10 business days, and your opt-out method must keep working for at least 30 days after you send the email. Under the GDPR, a person can object to direct marketing at any time, and you must then stop using their data for marketing. Gmail also requires bulk senders to offer one-click unsubscribe.
Is a pre-ticked box a valid opt-in under the GDPR?
No. The European Data Protection Board says pre-ticked boxes and opt-out constructions that require the person to act to prevent agreement are not valid consent. Silence or inactivity doesn't count either.