Privacy & Data

Is it safe to click unsubscribe?

October 21, 2026

9 min read

Copy Link

The short answer

Here's the rule we use at Yorba. If you can remember giving a company your email address, click unsubscribe. If you can't, leave everything in that email alone, the unsubscribe link included.

We call it the relationship test, and what it ignores matters as much as what it checks. It doesn't care how professional the email looks. A neat footer and a block of grey legal text are the cheapest parts of a marketing email to fake, so a scam that copies them has spent almost nothing to earn your trust.

Advice like this goes stale, so we'll date it. What follows reflects US law under CAN-SPAM and the rules Gmail and Yahoo set for large senders as of October 2026.

A real company wants you to unsubscribe

That sounds backward until you look at who's holding the leash. The law forces companies to let you go, and their own inbox placement gives them a reason to make leaving painless.

Start with the law. Under CAN-SPAM, the FTC's guidance gives a company 10 business days to honor your opt-out, and the opt-out has to keep working for at least 30 days after the email goes out. The law is stingy about what they can ask of you in return. They can't charge a fee or ask for personal information beyond your email address, and leaving can't take more than a reply or a visit to one web page. Once you're out, they aren't allowed to sell your address or pass it along either, except to a company they've hired to help them comply.

The faster rule comes from the inbox providers. Since February 2024, anyone sending more than 5,000 messages a day to Gmail has had to support one-click unsubscribe and process requests within two days. Yahoo set materially the same requirements. One-click has a specific technical meaning here, defined in a standard called RFC 8058: your mail app sends the request directly, with no confirmation page and no login.

Now the business reason, which is the part nobody tells you. A company you stop wanting mail from has two outcomes to choose between. You can unsubscribe, which costs them one reader. Or you can hit report spam, which counts against them with Gmail and Yahoo, both of which expect large senders to keep their spam complaint rate below 0.3%. Every marketer who knows their job would rather you left quietly. The unsubscribe link at the bottom of a real company's email is the door they want you to use.

The UK regulator, the ICO, gives the same advice. Use the unsubscribe link for organizations you recognize, and if the emails keep coming afterward, report it.

In spam, the unsubscribe link is a door you can't see behind

Everything above assumes a sender who follows the law. Spammers don't, so none of it protects you.

The classic worry is that clicking unsubscribe confirms your address is real. It's a fair worry. The ICO tells people that clicking any link in an email from an organization they don't recognize might confirm the address is live and make them a target for more spam. A list of addresses that belong to real, attentive people is worth more than a list of guesses.

Here is the uncomfortable part, though. By the time you're hovering over the link, the sender may already know. Many marketing and spam emails carry a tracking pixel, a tiny invisible image that tells the sender's server when the message was opened. If your mail app loaded images when you opened the email, that confirmation has probably happened already. Privacy International's guide on tracking pixels recommends turning off automatic remote image loading for exactly this reason.

So the bigger risk with the click is where it takes you. An unsubscribe link in a scam email can lead to a page dressed up as a brand you trust, asking you to log in to manage your preferences. That page is the point of the whole email. It wants your password.

That's why the answer to "does unsubscribing confirm my email" is a slightly annoying "sometimes, and that's not even the main problem." With an unknown sender, don't click anything at all.

How to tell which kind of email you're looking at

You are not checking whether the email looks legitimate. You are checking whether you have a relationship with whoever sent it. Four questions get you there.

Can you place them? Think of where your address would have come from: an order, an account, a newsletter you signed up for, a warranty card. If you can't place the sender, treat them as unknown, however familiar the name sounds.
Who is it actually from? Look at the sending address, not the display name. A message that says it's from your bank but comes from a domain your bank doesn't own is not from your bank.
What does the unsubscribe page ask for? A legitimate opt-out can't require more than your email address. If the page wants you to log in or type a password, close it. A real company under CAN-SPAM can't make that a condition of leaving, and a scam has no other reason to ask.
Is it rushing you? Scam emails lean on urgency, like an account about to close or a charge about to post. Marketing from a company you know rarely needs you to act in the next hour.

If any of these makes you hesitate, skip the link and use one of the options below instead.

What to do instead of clicking

For an unknown sender, mark the message as spam or junk and delete it. Don't reply, because a reply confirms your address just as surely as a click. Reporting it trains your provider's filter and counts against the sender, which is the only consequence most spammers ever feel. In the UK you can also report spam email to the ICO.

For a sender you recognize, you can still skip the link in the email body. Gmail shows its own unsubscribe link next to the sender's name on messages that carry the standard unsubscribe header, and using it means your mail app sends the request without opening a web page at all. Gmail's Manage subscriptions view, launched in July 2025, gathers subscription mail in one place and sends the unsubscribe request to the sender for you, though Google's help page still describes it as gradually rolling out. Outlook.com has a similar Subscriptions view under its mail settings.

If a company you recognize keeps emailing you more than 10 business days after you unsubscribed, it's breaking the law, and you can report it. In the US that complaint goes to the FTC.

The part an unsubscribe can't fix

We make Yorba, so here's where we come in, honestly. An unsubscribe is a request about one mailing list. It doesn't close your account or delete what the company holds about you. Nothing stops that company from starting a new list next season and putting you on it.

That's the gap Yorba was built for. The free plan unsubscribes you from mailing lists in a connected Gmail or Outlook inbox, and it also shows you the accounts behind all that mail, so you can decide which companies you want to keep at all. If you only want the newsletters gone, your inbox's built-in unsubscribe is free and does the job. If the mail keeps coming back however often you unsubscribe, you don't have an inbox problem. You have too many accounts, and that's the thing to clean up.

FAQ

Does unsubscribing confirm my email address to spammers?

It can. Clicking a link in spam tells the sender a real person is reading, which is why the ICO advises against clicking links in email from organizations you don't recognize. If your mail app loads images automatically, opening the email may have confirmed it already through a tracking pixel.

Is it safe to use the unsubscribe button in Gmail?

For senders you recognize, yes, and it's often the better option. The link Gmail shows next to the sender's name sends the request from your mail app without taking you to a web page. For senders you don't recognize, report the message as spam instead.

How long does it take for an unsubscribe to work?

Under CAN-SPAM, a company has up to 10 business days. Large senders mailing Gmail and Yahoo users are expected to act within two days. If mail keeps arriving after 10 business days, the sender is out of compliance.

Why am I still getting emails after I unsubscribed?

You may have left one list while the company keeps others, or the request may still be inside its 10-day window. Receipts and account notices are also a different category from marketing, so they keep coming for as long as the account exists.

Should I unsubscribe or mark as spam?

Unsubscribe from companies you signed up with. Mark as spam when you never gave the sender your address, because reporting real marketing as spam punishes a company for something you agreed to, while reporting actual spam is exactly what the button is for.

Can clicking unsubscribe give me a virus?

The realistic risk in a scam email is a fake page that asks for your login or a file you didn't ask to download. If an unsubscribe link starts a download or asks for a password, close the page and delete the email.