Unsubscribes, suppression, and CAN-SPAM

SEMAOS treats CAN-SPAM compliance as a hard gate: the product refuses to send email that would violate the two mechanical requirements, a working opt-out and a physical postal address. Both come from the FTC's CAN-SPAM compliance guide, which also says the law makes no exception for business-to-business email. This article covers who you may email in the first place, what's enforced on every send, what happens when someone unsubscribes, and how to manage the suppression list.

Who am I allowed to email?

Only recipients who consented to receive commercial email from you, or who have an existing business relationship with you (a customer, an active prospect who gave you their address). That rule comes from three places at once: our Terms of Service, the laws that govern commercial email (CAN-SPAM in the US, CASL in Canada, GDPR in the EU/UK), and the sender guidelines of the inbox providers your mail has to get through — Gmail's sender guidelines make consent an explicit requirement, not a courtesy.

In practice:

• Purchased, rented, scraped, or harvested lists are not allowed on any plan or channel. Importing one violates the Terms and is grounds for suspension.
• The CSV import asks you to confirm consent before any rows are written. That attestation is per-file and required — the import won't start without it.
• Consent ages. A list that opted in three years ago and hasn't heard from you since will bounce and complain like a cold list. Re-permission old lists before mailing them.

The bounce and complaint thresholds described in Deliverability and bounces are how this rule enforces itself mechanically: lists without real consent bounce and generate complaints. A bounce rate above the threshold throttles and then suspends sending automatically. Complaints have no automatic cutoff in SEMAOS, but each one suppresses that contact, and inbox providers penalize senders whose complaint rate climbs: Google asks senders to stay below 0.1% and never reach 0.3%, and Yahoo's sender requirements set the same 0.3% ceiling.

What does every email have to contain?

Two things, and SEMAOS enforces both at send time:

1. A working unsubscribe link. Templates place it with the {{system.unsubscribe_url}} merge field. The Simple editor writes the footer into every template it saves, so templates written there always carry one. The Designed editor lets you move or restyle the footer and shows a warning band if the merge field goes missing. A template without it cannot be sent at all:
   • One-off sends are refused, and the composer's preview tells you before you get that far: the email still renders so you can see the footer you need to fix, with the reason above it and the Send button switched off. An email you write in the composer gets the footer added for you, the same way the Simple editor does.
   • A sequence will not activate, and the error names the step at fault.
   • A broadcast is refused when you try to start it, before anything is queued. For an A/B test, every variant's template is checked, and the error names the variant at fault. If a broadcast holds part of its audience back to pick a winner, the template is checked again before the remaining recipients go out, in case it changed while the test was running.
2. Your physical mailing address, placed with the {{system.mailing_address}} merge field. The merge field fills in the address you entered during onboarding. If a tenant somehow reaches the send path without one configured, the send is refused outright rather than delivered without the footer. A virtual office registered as a commercial mail receiving agency (CMRA) satisfies the requirement; it has to be a real postal address, not a working office.
   • A template without the merge field is refused the same way as one without an unsubscribe link. A one-off send is refused, a broadcast is refused when you try to start it, and a sequence will not activate; the error names the step at fault.
   • A running sequence pauses rather than skipping. If a template in a sequence that is already running loses either merge field, the whole sequence pauses at that step, so no contact misses an email. Add the merge field back, then resume the sequence.

The unsubscribe link and the mailing address apply on both sending channels, mailbox and platform alike. Personal-feeling 1:1 mail is still commercial email under CAN-SPAM.

What happens when someone unsubscribes?

The moment a recipient confirms on the unsubscribe page, or uses their mail app's one-click unsubscribe button, their address joins your tenant's suppression list, and SEMAOS checks that list before every single send, on every channel. A suppressed contact is skipped by sequences, broadcasts, and one-off sends alike, and can no longer be enrolled in a new sequence. If they were already partway through one, every remaining step is skipped instead of sent, so no further email reaches them. There is no grace window and no channel where the suppression doesn't apply.

Two other events add contacts to the same list automatically: a hard bounce (the address doesn't exist, so continuing to send only damages your reputation) and a spam complaint (the recipient told their provider your mail is unwanted, which is stronger than an unsubscribe).

Where do I see and manage the suppression list?

Under Settings → Suppression. You can import a suppression list as a CSV, up to 10,000 addresses per file. If you're moving from another tool, do this before your first send so your old opt-outs come with you.

Anyone on your team can add an address by hand or import a file, and either way you pick one of three reasons: "Global suppression", "Opt-out" or "Invalid email". "Unsubscribed", "Complained" and "Hard bounced" aren't offered. SEMAOS records those itself when someone unsubscribes, marks your mail as spam, or their address bounces.

Can I remove someone from the suppression list?

Only an admin can remove entries, and only ones added by hand or imported with the reason "Global suppression", "Opt-out" or "Invalid email".

Entries recorded because the address unsubscribed, complained or hard-bounced stay on the list for good. Nobody in your account can remove them, admins included. The table shows a lock where the remove button would be, and you can't select those rows. If an entry locks while you have the page open and you then try to remove it, it stays on the list and the message tells you how many were kept.

The suppression belongs to the address, not the contact record. If you delete the contact and later import or add the same address again, it's still skipped on every send. And if an address you suppressed by hand later unsubscribes, bounces or complains, its entry switches to that reason and locks.

There's no override because re-mailing someone who opted out is what CAN-SPAM penalizes, at up to five figures per email. The FTC's guide puts the penalty at up to $53,088 for each separate email, and gives senders 10 business days to honor an opt-out; SEMAOS honors it the moment the recipient confirms, or their mail app's one-click unsubscribe button is used.

Why don't mailbox sends carry the List-Unsubscribe header?

Email has two unsubscribe mechanisms: the visible link in the body, and a hidden List-Unsubscribe header that inbox providers surface as their own unsubscribe button. SEMAOS adds the header on platform sends only, together with the List-Unsubscribe-Post header that makes it a one-click unsubscribe as defined in RFC 8058. Gmail and Yahoo require one-click unsubscribe on bulk marketing mail. Mailbox sends deliberately omit it, because the header is a bulk-mail convention: Gmail and Outlook use its presence as a signal to file mail as promotional, and a 1:1 email from your own mailbox filed as bulk defeats the point of mailbox sending. The body link and the suppression check still apply in full on both channels, so the recipient's ability to opt out is never reduced; only the bulk-mail signaling differs.

Does any of this apply to the free plan?

All of it. SEMAOS's compliance gates are about the mail you send, not the tier you pay for. Free-plan mailbox sends carry the same footer requirements and run the same suppression check as a Business-tier broadcast.