How agencies keep a per-client unsubscribe URL and compliance verdict required before every send
Most agency compliance failures are not dramatic. Someone clones a sequence into a new client workspace, the footer still points at yesterday's unsubscribe page, and a batch goes out before anyone notices. Or the opt-out URL works, but nobody recorded a pass/fail verdict, so the next send has no proof it was checked.
CAN-SPAM does not force a clickable link specifically. It requires a clear, conspicuous opt-out: a functioning return address or another Internet-based mechanism that stays available for at least 30 days, with requests honored within 10 business days. Hiring an agency does not move liability off the brand. Both sides can be on the hook. That is why agencies need an ops gate, not a hope-and-Slack process.
GTM treats the compliance gate as a database constraint: no send without a verdict and an unsubscribe URL. The rest of this post is the agency procedure that makes that constraint real across many clients.
What "required before every send" means in practice
Define two fields that must be present and valid on the campaign (or workspace send config) before the queue can dequeue:
- Unsubscribe URL scoped to this client sender identity, not the agency brand.
- Compliance verdict with status, checked_at, checked_by, and notes.
A null URL fails closed. A stale verdict fails closed. "We will fill it in later" is a failed send, not a warning toast.
Keep the URL owned by the client workspace. Shared agency footers across clients are how you mix brands and how you lose the audit trail when a prospect opts out of Client A and somehow lands on Client B's preference page.
Build the per-client unsubscribe checklist
For each new client workspace, before first send:
- Confirm the physical postal address that will appear in commercial messages for that sender.
- Stand up a client-scoped opt-out page (or return-address path) that can receive requests for 30+ days after each send.
- Wire the page (or mailbox) into the client suppression list, not a global agency dump that operators cannot explain later.
- Record who owns honoring opt-outs within 10 business days.
- Store the live URL on the send config and freeze edits behind a role that can change compliance fields.
Test the path end to end: click unsubscribe from a seed send, confirm the suppression write, confirm the contact cannot re-enter active sequences without an explicit, logged override.
Make the verdict a real object
A checkbox named "compliant" is theater. A useful verdict looks like:
pass|fail|expired- Timestamp
- Operator or automated checker identity
- What was inspected (URL reachable, footer copy present, postal address present, suppression write path tested)
- Expiry rule (for example, re-check after URL change, domain swap, or 30 days)
Auto-expire the verdict when the unsubscribe URL changes, when the sending domain changes, or when the footer template version changes. That is how you stop a one-time QA pass from covering months of drifted copy.
Gate placement that agencies actually enforce
Put the check as close to send as you can without inventing a second system of record:
- Campaign cannot move to "ready" without URL + non-expired pass verdict.
- Queue worker refuses dequeue if either field is missing or expired.
- Human override requires a named role and a reason string that lands in the audit log.
If your stack cannot enforce this in the database, enforce it in the ops runbook and treat any bypass as an incident. Soft warnings get ignored on busy Fridays.
Multi-client failure modes to watch
- Sequence clone copies the previous client's unsubscribe URL.
- Client IT rotates the preference-center domain and nobody updates the send config.
- Opt-out lands in a shared inbox and never writes to the client suppression list.
- Agency footer still lists the agency postal address when the commercial sender is the client brand.
Each of those is a gate miss, not a "deliverability quirk."
Weekly ops board
Run a short board per client:
- Active campaigns with pass verdicts and next expiry
- Campaigns blocked for missing URL or expired verdict
- Opt-outs received vs suppression writes in the last 7 days
- Any override used and why
Agencies that can show that board during a buyer security review look serious. Agencies that only say "we include unsubscribe links" are guessing.
The point is simple. Commercial email needs a working opt-out path. Agency outbound needs that path per client, plus a recorded verdict that blocks send when either piece is missing. Put both in the send path, not in a Notion page nobody opens.
Sources: FTC CAN-SPAM compliance guide, eCFR 16 CFR Part 316, 15 U.S.C. section 7704, Allegrow CAN-SPAM 2026 guide, GTM product knowledge.