Documentation
Sign inGet started
Get started
Guides
API Reference
SDKs
CLI
Knowledge Base
Changelog

Email · list consent and CAN-SPAM

This article summarizes CAN-SPAM requirements, list consent, and Bird's unsubscribe behavior. It is not legal advice; ask your legal adviser which rules apply to your messages and recipients.
Gmail and Yahoo also require one-click unsubscribe and low complaint rates from bulk senders. See Gmail and Yahoo sender requirements.

What CAN-SPAM requires

CAN-SPAM is a US law that covers commercial email. Its requirements include:
  • Accurate From and subject. The From name, From address, and subject line must honestly identify who is sending and what the message is about. No misleading sender names, no bait-and-switch subjects.
  • A physical postal address in marketing mail. Every commercial message must include your valid physical postal address: a street address, PO box, or registered commercial mail receiving agency. Put it in the footer of every marketing template.
  • A clear way to opt out. Every commercial message needs a conspicuous unsubscribe mechanism that works without a login or a fee.
  • Honor opt-outs promptly. CAN-SPAM allows up to 10 business days, while Bird applies unsubscribe suppressions immediately.
CAN-SPAM distinguishes commercial content from transactional or relationship content. Ask your legal adviser how the message's primary purpose affects the requirements. Do not use a transactional category to bypass a marketing opt-out.

What valid list consent looks like

Consent requirements vary by jurisdiction and message type. Use express consent for marketing when required, and keep evidence of the recipient's choice:
  • Express consent is a clear affirmative action, such as selecting an unticked box or submitting a dedicated signup form.
  • Implied consent (an existing customer relationship without an explicit marketing opt-in) is weaker. Some jurisdictions accept it in narrow circumstances; others do not. If you rely on it, keep the mail closely related to the existing relationship and provide a clear opt-out.
  • Do not buy, rent, or scrape lists. They do not establish that recipients consented to receive messages from you and may violate Bird's Acceptable Use Policy.
Keep records. For each subscriber, store when and where they signed up, what the signup form said, and ideally the IP address and a confirmation timestamp. Double opt-in (a confirmation click before the first marketing send) gives you the strongest record and the cleanest list.

How unsubscribes work

The mechanical side of opt-outs is handled for you:
  • One-click List-Unsubscribe headers. RFC 8058 one-click unsubscribe headers are added (List-Unsubscribe and List-Unsubscribe-Post) to marketing mail automatically. This powers the built-in unsubscribe control in Gmail, Yahoo, and other clients, and it is a hard requirement for bulk senders at Gmail and Yahoo.
  • Unsubscribes take effect immediately. An unsubscribe link emits email.unsubscribed; the one-click header emits email.list_unsubscribed. Both add the address to your workspace suppression list with reason: unsubscribe. The next marketing send to that address is rejected before delivery.
  • Complaints also suppress marketing mail. A spam complaint (email.complained) adds a suppression with reason: complaint.
You still own the content side. Include a visible unsubscribe link in your marketing templates because the header alone does not meet CAN-SPAM's "conspicuous" requirement. Subscribe to the email_suppression.created webhook to mirror suppressions into your own marketing database.

Why transactional mail still gets through

Unsubscribe and complaint suppressions block only non-transactional mail. A recipient who unsubscribed from your newsletter still gets password resets, receipts, and security alerts. Those are messages their own actions require, and stopping them would break your product for them.
Categories control suppression policy. The default marketing category respects unsubscribe and complaint suppressions. The transactional category can deliver through them, so use it only for operational messages such as receipts or password resets. Do not label marketing content as transactional to bypass an opt-out.

Next steps