Unsubscribe mechanism functional for 30 days after email sent

CAN-SPAM §5(a)(4) requires unsubscribe mechanisms remain functional for at least 30 days after an email is sent. A token stored in Redis with a 7-day TTL breaks this requirement silently — every email delivered after day 7 contains a link that returns 404 or 410. CWE-613 (Insufficient Session Expiration) captures the pattern: tokens tied to campaigns, Redis TTLs, or short-lived sessions all create a window in which delivered emails become irrevocable but non-actionable, which is the definition of a broken opt-out mechanism under federal law.

Store unsubscribe tokens at the subscriber level in your primary database — never in Redis with a TTL, and never keyed to a campaign record that can be deleted.

// Prisma schema — per-subscriber token, no expiry
// model Subscriber {
//   id           String   @id @default(cuid())
//   email        String   @unique
//   unsubToken   String   @unique @default(cuid()) // stable, lives forever
//   marketingOptOut Boolean @default(false)
//   optOutAt     DateTime?
// }

// Use the token as a stable footer URL in every email:
// https://example.com/api/unsubscribe?token=${subscriber.unsubToken}

If you rotate tokens after opt-out for security reasons, keep the old token in a revoked_unsub_tokens table that still resolves to the subscriber's opt-out record — never hard-delete a token that was included in a delivered email.