So, that means I shouldn't have to login to my account to unsubscribe, correct? I find this annoying as I tend to click on the unsubscribe link from my phone, and not have the login details with me. I've seen several prominent companies that do this, including Mint earlier today.

Yes that is not permitted - they need to use encoded links in the email to identify you automatically upon click.

The links do not need to be encoded -- they are allowed to ask for your email address -- but they can't ask for much else. And definitely not a username/password.

Funny, even big sites like LinkedIn break this. Is there some exception to some types of mail, like bulk mail received after signing up with a service?

You are correct.

I would not interpret "visiting a single page" to mean one-click. Of course, I agree that one-click is the right way to do things.

I think "visiting a single page" means precisely one-click.

Because once click takes you to the page. Any further action, even while you're on that same page, is an additional requirement, which is disallowed.

It allows requiring an email address.

How could you unsubscribe an email address without asking which one?

You provide a special link that someone can follow that has an ID of some type associated with the email.

It is the spirit if not the letter of the law. Nobody intended someone to use 50 AJAX steps on a single page to skirt the law.

And, moreover, requiring a login or any personal information to unsubscribe is specifically disallowed by the law.

With the important exception of an email address. Most of the time the part that annoys me the most is entering that because at best I have to check what it was sent to (many email accounts all going into one gmail) and at worst, it wasn't sent directly to me, so I have to try harder.

I love that, but unfortunately CAN-SPAM is a US law, not a universal law.

Sure, but it applies to the many, many US-based tech companies. And I know Canada, Australia, and the UK have similar laws.

The thing is, how do you even prosecute it? Where the company is based? Where the web servers are based? Where the email servers are based? Where it was served? The email client's server location?

As long as the company does business in the US, you have enough of an argument to drag them into court over it. Whether or not that is worth your time (or will ultimately net you anything) is anyone's guess.

Can you actually drag a company into court over CANSPAM? I was under the impression it was FTC fines only.

Consumers can't really take any action on their own, but ISPs can. Microsoft has been pretty active in this regard. My understanding is they use this to file charges against John Doe spammers so that they can use court procedures to track down their actual identity. IANAL.

There are a lot of things wrong with the CAN SPAM Act, but this is not one of them. It applies to any company where the US can claim jurisdiction which, at the very least, includes every US based company. It does not matter how or where the emails are sent.

the company can in the U.S. at least get hit with an FTC fine.

You can find practically nothing, except for some initial cases many years ago, where someone has been prosecuted for can-spam. I would imagine that like with any crime, you would have to really piss some people off to fall under this act.

(Smoking marijuana is a crime as well as is driving over the speed limit and a host of other things that generally don't land you in hot water even if they are known to the authorities.)