Opt-Outs and Suppression Lists: How to Honor a Stop Request in Every Tool

By Laurel · Updated Oct 8, 2026

An opt-out is any signal that a person wants no more outreach: a click, a reply, a spam report, a "don't call me." A suppression list is the one record of those signals that every email, call and message checks before it goes out. It makes a single stop request stick across tools, list imports and vendor changes.

The easy case is an unsubscribe click inside one sequencer. The hard cases are the dialer that still holds the number, the WhatsApp inbox that never heard about the email reply, and next quarter's data import that brings the address back. Reply handling is in handling replies and booking meetings, and sender thresholds in the deliverability guide. This is general information, not legal advice.

Key Facts

• RFC 8058 defines one-click unsubscribe: two headers, an HTTPS URI, and a DKIM signature covering both headers.
• Google requires one-click unsubscribe above 5,000 messages a day to Gmail, and its FAQ counts requests not honored within 48 hours as a failure. Yahoo asks bulk senders to honor unsubscribes within 2 days.
• The FTC says CAN-SPAM has no business-to-business exception, requires opt-outs to be honored within 10 business days, and allows penalties of up to $53,088 per violating email.
• The ICO calls the right to object to direct marketing absolute and prefers suppressing a person's details to erasing them.
• WhatsApp's Business Messaging Policy requires you to respect opt-out requests made on or off WhatsApp.

What Counts as an Opt-Out

Teams design for the unsubscribe button because it produces a clean event. But the ICO says an objection to direct marketing can be made verbally or in writing, to any part of an organization. So opt-outs also arrive as replies, call notes, spam complaints, hard bounces, register listings and privacy requests. The legal limits follow later.

One-Click Unsubscribe: The Standard Behind the Button

What RFC 8058 Specifies

RFC 8058 lets a mailbox provider unsubscribe a recipient with one click and no web page. The sender adds two headers to the message:

List-Unsubscribe: <https://mail.example.com/u/7f3a9c2e>, <mailto:unsubscribe@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The specification also requires:

• One HTTPS URI that identifies the recipient and list through a hard-to-forge token your server verifies.
• A DKIM signature covering both headers.
• An endpoint that handles the POST the provider sends on click and completes the unsubscription automatically: no confirmation page, no login, no redirect.

The standard solves the hop from the recipient's mailbox to your sender. The hop from your sender to everything else is yours. The POST lands wherever the URI lives, usually the sequencer, and if that system records the unsubscribe only in its own database, the CRM and the dialer never learn of it. To test, send to a personal Gmail account, open "Show original" to confirm both headers and a DKIM pass, click unsubscribe, and time how long the address takes to reach your master list.

What Google and Yahoo Require

Google requires senders above 5,000 messages a day to Gmail to support one-click unsubscribe on marketing and subscribed messages and to show a visible unsubscribe link. Its FAQ recommends fulfilling requests within 48 hours and counts missed ones against a sender's eligibility for delivery support. Yahoo asks bulk senders for a one-click header, a visible link and unsubscribes honored within 2 days.

Neither provider defines whether a one-to-one sales email counts as marketing, so adding the header is the lower-risk reading. Also avoid a confirmation step, a preference menu with no "stop all" option, or a link that stops working within 30 days of sending; the FTC guide and RFC 8058 between them rule these out.

The Legal Outer Limits

Law sets the latest moment you may keep sending, not the right moment to stop. This summarizes what regulators publish and isn't legal advice.

United States

The FTC's CAN-SPAM guide requires honoring an opt-out within 10 business days, with no exception for business-to-business email. The mechanism must keep working for 30 days after you send, and can't charge a fee or demand more than an email address. You can't sell or transfer an opted-out address, or contract away responsibility: the sender and the company whose product is promoted can both be liable. So an agency's suppression list must include yours, and yours must receive theirs.

United Kingdom and EU

The ICO says PECR's email consent rule doesn't cover corporate subscribers, but you should still comply with their opt-outs. Sole traders are individual subscribers who generally need to have consented. Under UK GDPR the right to object to direct marketing is absolute, and you must comply without undue delay and within one month at the latest. The ICO notes this guidance is under review following the Data (Use and Access) Act.

In the EU, Article 21 of the GDPR gives people the right to object to direct marketing at any time, ends processing for that purpose once they do, and requires the right to be presented clearly and separately at the first communication at the latest. In practice that puts the opt-out wording in the first email.

Singapore and the Rest of Southeast Asia

Under the PDPC's Do Not Call guidelines, a person can withdraw consent by notice and the sender must stop within 21 days. Malaysia, the Philippines, Vietnam and Indonesia have their own personal-data laws, which the outbound sales playbook lists with sources.

Treat Plain-Language Requests as Opt-Outs

"Please remove me," "stop emailing me," "I never agreed to this" and "how did you get my number?" are opt-outs whatever the wording. The replies guide sorts reply types; the suppression rule layered on top is short:

• Not now: pause the sequence and set a follow-up date.
• Not interested: stop the sequence, and decide in writing whether re-approach is allowed after a cooling-off period.
• Anything asking you to stop, remove or never contact: suppress. When unsure, suppress.
• A question about where you got their data: suppress and route it to whoever owns privacy requests.

Give an AI reply classifier the same bias: a false suppression costs one prospect, a missed one costs a complaint. And make suppression one click wherever requests land, from the shared inbox to the call outcome list.

One List as the Source of Truth

Choose one system as the master, usually the CRM, because it already holds the contact, the account and the history. Every sending tool reads the master before it sends and writes new opt-outs back to it. A sequencer's own "unsubscribed" flag is a cache, never the record.

Two timing rules prevent most leaks. Check at send time, not enrollment time, because people opt out after being queued for step three. And reconcile suppression counts across tools on a schedule, since a tool 40 entries short has a broken integration. The lead data management guide covers the wider governance setup.

Keep entries small: the ICO describes suppression as retaining just enough information to respect the preference in future. A workable entry holds:

• Identifiers: lowercase email, phone in international format, LinkedIn URL, CRM person ID. Match on the person, not just the address, because one buyer may have a work email, a personal one and a mobile.
• Scope: email, phone, WhatsApp, LinkedIn or all.
• Reason code: unsubscribe, reply, complaint, bounce, register, objection or company request.
• Source and time: the tool, the message or call ID, a UTC timestamp, and the exact wording if the request was free text.

Companies, Domains, Role Accounts and Exclusions

Company Requests

Read a request literally. One person's opt-out suppresses that person. If someone with authority writes "take our company off your lists," flag the account and suppress its domains. Domain-level suppression is for company domains only, because suppressing gmail.com would block millions of unrelated people.

Role Accounts

An opt-out from a shared mailbox such as info@ or sales@ speaks for everyone who reads it, so suppress the address and consider the account. The prospect list guide treats shared inboxes as a fallback, not a target.

Customers, Open Deals and Other Exclusions

Customers, contacts on open opportunities, partners, competitors and former employees shouldn't get cold outreach even though they never asked you to stop. Keep these as exclusions with their own flag and reason. An exclusion is a business rule that ends when the deal closes or the contract lapses. A suppression is a permission signal that only the person can reverse. Store them separately and a deal closing as lost can never silently lift an opt-out.

Hard Bounces and Spam Complaints

SMTP class 5 codes are permanent failures under RFC 3463, ones that resending won't fix, and 5.1.1 means the mailbox address is bad. Suppress hard bounces permanently. Google suggests automatically unsubscribing recipients with multiple bounces, and Yahoo says to remove invalid recipients promptly. Neither sets a count for soft bounces, so choose a threshold and write it down.

A 5.x.x code isn't always a dead mailbox. Microsoft's 550 5.7.515 rejects your sending domain for failing authentication and says nothing about the recipient. Fix the sender, not the list, using the infrastructure guide.

A spam report is an opt-out delivered the harshest way. Suppress the address immediately and, as policy, from every channel. Yahoo's complaint feedback loop exists to help senders keep lists clean, so enroll your domains where one is offered.

Calls: Registers and Your Own List

The ICO says to screen numbers against TPS and CTPS, notes that a registration can take 28 days to become active, and says to keep your own do-not-call list rather than delete the person. Singapore's PDPC sets a Registry check's validity at 21 days. The FTC says sellers must sync with the National Do Not Call Registry at least every 31 days and honor a request not to be called by that company, and that most calls to a business to solicit sales from it are exempt. More in cold calling fundamentals.

In practice:

• Make "do not call" a call outcome that writes to the master list the same day.
• Scope a suppression to the channel the person named, but treat an unscoped "stop contacting me" as all channels. The PDPC treats an unscoped withdrawal as covering only the channel it came through, which makes all channels the safer default.
• Re-screen before each dialing wave, not once a quarter.

WhatsApp and Messaging Apps

WhatsApp's Business Messaging Policy requires you to respect all requests, on or off WhatsApp, to block, discontinue or opt out, and to give clear opt-out instructions. It also makes you responsible for an opt-in method that complies with applicable law. Three things follow:

• An email "stop" binds your WhatsApp account. The master list, not the chat inbox, decides.
• Handle STOP in the webhook. Match the keyword, write the number to the master list, confirm once and go silent.
• Singapore numbers carry a second test. The PDPC rules reach WhatsApp, iMessage and Viber messages to Singapore numbers.

WhatsApp for B2B outreach covers templates, the 24-hour window and opt-in wording.

Records: What to Log and How Long to Keep It

Opt-out records and consent records are different things. For consent, the PDPC says to keep system logs of the person's choice, the date and time, the page or form they saw, and the clauses they agreed to. Keep that evidence for as long as you intend to rely on the consent, within the PDPA's retention limit. The same four fields suit a WhatsApp opt-in, and the GDPR chat funnel guide recommends a dedicated CRM field so the record survives a tool switch.

For suppression entries, none of the rules above sets an expiry. The ICO's logic is to keep enough to respect the preference in future, so keep the entry for as long as you could otherwise contact the person, and keep it small. For erasure requests, suppress rather than delete, because a deleted record lets the next data purchase add the person back.

Re-Imports, Data Vendors and Tool Changes

Suppression fails at the seams, when data moves.

• Re-imports. A rep uploads last year's spreadsheet, an event scan adds a lapsed contact, a vendor re-delivers a record. The master list wins over every re-add, checked at import and again at send. Only a new, affirmative action by the person, such as requesting a demo, reopens contact, and it's logged as its own event.
• Data vendors. The CAN-SPAM ban on transferring opted-out addresses reaches the files you buy, so screen each purchased file against your master first. The contact data guide covers the privacy side.
• Tool changes. Before cancelling a sequencer, dialer or agency, export its unsubscribed, bounced and blocked lists into the master, and require vendors to return suppression data at termination.
• New sending domains. A person opted out of you, not of one domain. Every mailbox must read the same list, including those in a multichannel cadence.

A Monthly Check That Catches the Leaks

Put a test address on the master list, then try to enroll it in every sequencer, import it to every list, add it to the dialer queue and message it on WhatsApp. Anything that goes through is a leak. Also sample 20 recent "remove me" replies and confirm each reached the master with the right scope.

A CRM that holds contact, source and activity history in one record, such as Rework's Sales Ops and Lead Ops, is a natural home for the master list. Whatever you choose, start this week: export the unsubscribed list from every tool into one sheet and count the addresses that appear in some tools but not all. That number is the size of your leak.