1

With all the data protection stuff these days I was wondering if it is possible to sue a company for making a user pass a CAPTCHA test when unsubscribing from email.

I don't know the law surrounding this issue but the user experience is horrendous:

I get an email that I don't want from a company I don't really care about into my personal inbox. They provide a link below, as legally mandated I believe, for me to be able to unsubscribe from their mailing list. I am directed to an external URL where most companies quickly confirm the saved preferences. Why should I need to pass a CAPTCHA when an email was clicked directly from my inbox? This is mostly hypothetical right now, but I am wondering if there are any laws (e.g., GDPR) that would make this actionable.

  • Even if there are GDPR-like laws covering this, it's far more likely that the company would be required to pay a fine to some government/regulatory body, and not you. For you to successfully sue them you'd probably have to show and quantify how you were 'damaged' by their actions... – brhans Aug 29 at 13:07
  • Right. Could you also not argue they're making it artificially harder to unsubscribe from their emails? – Scott Skiles Aug 29 at 15:15
  • Sure you could - but what actual harm have you suffered which you would be suing them to compensate you for? 30 seconds of your time and a minor annoyance is worth what ... $0.50 ... ? – brhans Aug 29 at 16:27
  • You can provide a simple unsubscribe link, or you can make it too complicated and I will simply flag the message as spam. Then not only I, but also your other potential customers will stop seeing it. Your choice. – Consis Aug 29 at 16:28
4

According to 10 rules for getting email unsubscribes right on Econsultancy, the GDPR says of unsubscribing (my emphasis):

There is no specific rule about how companies should allow unsubscribing from email, but the General Data Protection Regulation (GDPR) does state that removing consent should be as easy as giving it. This means that if businesses try to make it difficult or confusing they may find themselves receiving complaints.

So, assuming they do not otherwise hinder unsubscribing in some of the ways described on that page, would having to pass a Captcha test stop unsubscribing being as easy as signing up?

Obviously, it can depend on exactly how you sign up. Some processes may have involved a Captcha test in the first place, or validating your email to activate an account: in such cases, it feels like a clear draw. Even if all that was involved to sign-up was to enter your email-address on a web-page, then passing a single Captcha test doesn't really sound like a significant difference.

Also, much as I hate "defending" companies that try to flood you with emails, there are some practical reasons for including something like a Captcha test. In your question you say "when an email was clicked directly from my inbox". However, they don't necessarily know it came directly from your inbox:

  • Depending on the format of the link, it may be possible for a mischievous third-party to spoof requests to the unsubscribe page. A Captcha helps ensure a human actually did the clicking.

  • Even if the format of the link is "encoded" in a way to make it "spoof-proof", it is known that some email clients might "pre-visit" links they find in emails (see, How to stop e-mail clients from visiting links in e-mail automatically? on StackOverflow). One of the reasons for doing this, I believe, is to help protect users from dangerous links in "phishing" and similar emails. However, it can also mean that without some kind of secondary confirmation (e.g. Captcha), people could get unwittingly auto-unsubscribed by their email client.

Overall, I would say that a Captcha alone is not sufficient to hinder the unsubscribing process to the point you can hit them with things like GDPR, especially as there are some practical justifications for including one.

  • Wonderful answer! Thank you. – Scott Skiles Aug 29 at 23:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.