How agencies document opt-out and CAN-SPAM proof per client workspace
Agencies get asked two questions after a complaint: did you offer a working opt-out, and can you prove you honored it. "We think the ESP handled it" is not proof. CAN-SPAM puts responsibility on both the company whose product is promoted and the company that sends. If you run outbound for many brands, you need evidence per client workspace, not a shared spreadsheet that mixes Client A and Client B.
GTM keeps a compliance gate in the database so sends need a verdict and an unsubscribe URL. Documentation is how you show what happened after that URL was used.
What the FTC actually requires (ops translation)
From the FTC's CAN-SPAM compliance guide for business:
- Commercial email needs a clear way to opt out
- That mechanism must keep working for at least 30 days after the message was sent
- You must honor a request within 10 business days
- You cannot charge a fee or demand extra personal data beyond the email address
- You cannot sell or transfer opted-out addresses except to a firm helping you comply
- Hiring an agency or ESP does not erase the brand's responsibility; monitor what others do on your behalf
Civil penalties can reach $53,088 per violating email under the FTC's inflation-adjusted figures cited in the guide. Treat that as a reason to keep boring logs, not as a marketing scare line.
Why "per client workspace" matters
One agency often sends for many brands. An opt-out for Brand A must not vanish into a global list that Brand B cannot explain, and it must not leak into Brand B's audience either.
For each client workspace, store:
- Brand identity shown in the From line and footer
- Physical postal address used in commercial messages
- Unsubscribe URL (or reply-based mechanism) that was live for that send
- Suppression list scoped to that client
Cross-client suppression sharing is a compliance incident waiting to happen.
The minimum evidence row for every opt-out
When a request arrives, write one durable row:
- Received_at (timestamp with timezone)
- Source (unsubscribe link click, reply keyword, preference center, manual CRM flag)
- Email (normalized) and any domain-level scope if the request was broader
- Campaign / sequence / message_id when known
- Client_workspace_id
- Processed_at and processor (system or human)
- Action (suppressed email, suppressed domain, removed from active sequences)
- Evidence (ESP webhook payload id, ticket id, screenshot of preference confirmation)
If you cannot rebuild that row six months later, you do not have proof. You have a vibe.
Proof the mechanism still worked for 30 days
CAN-SPAM cares that the opt-out path still functioned after send. Practical checks:
- Weekly synthetic unsubscribe on a seed address per active sending domain
- Alert if the landing page 404s or the webhook fails
- Confirm spam filters are not eating reply-based opt-outs
- Keep the footer URL stable across template edits
Log the synthetic tests the same way you log real requests. Auditors and careful buyers like boring repetition.
Proof you honored within 10 business days
Measure processing time, do not assume it.
- Auto-suppress on webhook within minutes when you can
- Queue human review only for ambiguous cases (whole-company vs one alias)
- Dashboard: open opt-outs older than 3 business days
- Hard stop: no new commercial sends to that address once the request is recorded, even before the legal deadline
Faster than 10 business days is normal good ops. The statute is the ceiling, not the target.
Vendor oversight notes agencies forget
FTC point eight is the awkward one: you must monitor what others do on your behalf.
Keep in the workspace file:
- Which ESP / sequencer / GTM workspace sends for this brand
- Who can upload lists
- Last date suppression sync was tested end-to-end
- Contract language that the brand remains responsible and the vendor must honor suppression
If a junior operator re-imports an old CSV and bypasses suppression, the log should show the block or the incident. Silence is not compliance.
Tie-in to the send path
Before send, the compliance gate should already refuse messages without unsubscribe URL and verdict. After send, the proof system watches the reverse path: request in, suppress, confirm no further commercial mail.
Those are two sides of the same control. Agencies that only polish the footer and never log the honor step fail the second question buyers ask.
Operator checklist (paste into the workspace runbook)
- Footer address and unsubscribe URL ownership named per client
- Opt-out evidence schema fields above exist in storage
- Synthetic unsubscribe test scheduled
- SLA dashboard for processing age
- Sequence enrollment checks suppression before add
- Manual CSV import path also checks suppression
- Quarterly export of opt-out evidence available to the client
Where GTM fits
GTM is built for agencies that need client-isolated outbound with a compliance gate that stays on. Documentation of opt-outs is how you defend that gate when a lawyer or a buyer asks for the trail.
Join the waitlist when you want that motion in one workspace: trygtm.com/waitlist.