Unsubscribe requests honored within 10 business days

CAN-SPAM §5(a)(4) requires opt-out requests be honored within 10 business days, but queuing the request for batch processing is the wrong implementation — the correct baseline is immediate synchronous suppression at the moment the user opts out. A 24-hour queue window means opted-out users keep receiving emails throughout that window, creating both a legal violation and a genuine user harm. GDPR Art. 7(3) reinforces this: the right to withdraw consent must be as easy as giving it, and any delay between withdrawal and cessation of processing is difficult to defend. CCPA §1798.120 grants a similar opt-out right with no delay tolerance.

Make suppression synchronous: write marketingOptOut: true to the database before returning a response from the unsubscribe handler. Never queue this operation.

// app/api/unsubscribe/route.ts — synchronous suppression
export async function POST(req: Request) {
  const { token } = await req.json()
  await db.subscriber.update({
    where: { unsubToken: token },
    data: { marketingOptOut: true, optOutAt: new Date(), optOutSource: 'email-link' },
  })
  return Response.json({ ok: true })
}

// All marketing queries must filter before sending
const eligible = await db.subscriber.findMany({
  where: { marketingOptOut: false, emailVerified: true },
})

If you use a third-party list provider (Mailchimp, Klaviyo), do not maintain a parallel database that could fall out of sync — use the provider's API as the authoritative suppression source.