How Many Days Do You Have to Honor an Email Unsubscribe Request Under CAN-SPAM?

Under the CAN-SPAM Act, a sender must stop emailing a recipient within 10 business days of that recipient's opt-out request. The FTC states this requirement directly in its consumer guidance and has enforced it in past settlements — the clock starts when the request comes in, and it runs in business days, not calendar days.

Why the "Business Days" Distinction Matters

Some marketing blogs describe the window as 10 calendar days, but that conflicts with the FTC's own wording. The FTC's consumer alert on CAN-SPAM enforcement explicitly says a company "must honor your request within 10 business days," and the agency's past settlement announcements use the same business-day framing. A sender that treats the deadline as 10 calendar days is giving itself less margin than the law actually requires, which is a safe direction to err in, but conflating the two can cause confusion when auditing a compliance process against the actual statute.

What Counts as a Valid Opt-Out Request

CAN-SPAM requires every commercial email to include a working opt-out mechanism, and that mechanism has to keep working for at least 30 days after the message was sent. The sender cannot charge a fee, require the recipient to provide more than an email address, or require more than a single step beyond replying or visiting one page to opt out. Once that request lands, the 10-business-day clock begins — there's no separate grace period for "processing" beyond that window.

Enforcement Has Real Teeth

This isn't a theoretical requirement. The FTC pursued email marketer Yesmail in a documented case for continuing to send messages to recipients more than 10 business days after they had opted out — in that case, Yesmail's own spam filter had been swallowing some of the incoming opt-out requests, which the FTC treated as the sender's problem, not an excuse. The lesson for any business running its own email program or managing one for clients: an opt-out that silently fails to register internally is still a violation once the 10-business-day window passes, regardless of why it failed.

What This Means for Your Email Stack

Most reputable email service providers (Mailchimp, Klaviyo, HubSpot, and similar platforms) process unsubscribe requests immediately and automatically suppress the contact from future sends, which puts you well inside the legal window by default. The risk shows up in custom-built systems, multi-platform setups where a contact exists in more than one tool, or manual list management where an opt-out has to be propagated by hand across systems. Any of those setups needs an explicit check that opt-outs flow through to every sending system within the 10-business-day limit, not just the platform where the original request arrived.

Bottom Line

Treat 10 business days as the maximum, not the target — audit your email stack today to confirm opt-outs actually suppress sends immediately and across every system a contact's email address lives in, not just the one where they clicked unsubscribe.

Sources: Federal Trade Commission consumer alert, "FTC Lawsuit Reminds Businesses: CAN-SPAM Means Can't Spam" (consumer.ftc.gov); FTC settlement coverage of the Yesmail CAN-SPAM enforcement action (reported by Computerworld and InfoWorld).