The $650,000 Lesson: Why Broken Opt-Outs Fail

In August 2023, Experian Consumer Services paid the FTC $650,000 for something that sounds almost mundane: people couldn't actually unsubscribe from its marketing emails. The penalty, plus a permanent injunction, came with maximum exposure of up to $51,744 per violating email, according to FTC enforcement reporting.

What makes the case instructive is how basic the failure was. The FTC didn't catch Experian on an obscure technicality. As compliance analysts noted, the violation "came down to something fundamental: consumers were not given a clear, working way to unsubscribe from marketing messages." Recipients who tried to opt out hit circular messaging or were told they would keep receiving messages anyway. The agency treats that as a violation even if a technically functional link exists somewhere in the email.

The "primary purpose" test is the other half of the lesson. Experian labeled promotional emails as "important information about your account," framing upsells and credit card offers as account notifications. The FTC applies a primary purpose test: if an email's real function is promotion, it carries full CAN-SPAM obligations regardless of the label on it. That means a valid physical postal address, honest subject lines, and a working opt-out mechanism that stays live for at least 30 days after sending, with requests honored within 10 business days.

This matters for any business running automated follow-up, because the same logic applies across channels:

• An appointment reminder with a coupon bolted on can shift the message into promotional territory and change your obligations without you noticing, as practitioners in the SMS space warn.
• Third-party sending doesn't shield you. Brands remain responsible for CAN-SPAM compliance even when affiliates or partner networks send the emails.
• A broken opt-out risks more than fines. It drives spam complaints that damage sender reputation and deliverability over time.

For businesses that rely on speed to win leads, the compliance lesson is simple: opt-out has to be automatic and immediate, not something a busy team gets around to. CallMyLeads builds that into its lead response and nurture workflows, honoring opt-outs the moment they arrive across every channel, so persistence in follow-up never crosses into the territory that cost Experian $650,000. Slow responses lose jobs; ignored opt-outs lose far more.

Hard Deadlines and Functional Requirements

The deadline is not a suggestion. Under the CAN-SPAM Act, once someone asks to leave your list, you have 10 business days to honor that request, according to compliance guidance on CAN-SPAM penalties. Miss it, and the exposure adds up fast: the FTC can seek up to $51,744 per violating email, the kind of math behind the $650,000 penalty against Experian Consumer Services in August 2023.

The second clock runs longer but matters just as much. Your unsubscribe mechanism has to stay live and working for at least 30 days after you send a message. That's not a technicality you can set and forget. If the link breaks, expires, or leads nowhere, the opt-out no longer exists in any meaningful sense.

And here's the part that trips up a lot of senders: a link alone doesn't satisfy the law. The FTC looks at whether the process actually lets someone leave. Circular messaging, extra steps, or a page that keeps pushing the recipient back into marketing content counts as blocking, not compliance. Experian's violation wasn't exotic. As one compliance analysis put it, consumers simply weren't given a clear, working way to unsubscribe.

What a compliant opt-out actually requires:

• A working unsubscribe link or reply-to address that stays functional for at least 30 days after sending
• Honoring every request within 10 business days, with no extra steps or confirmation hoops
• No re-subscribing someone or continuing to send after they've opted out
• The same standard applied to messages sent by third parties on your behalf, since liability follows the sender

This is where email and text messaging start to blur in practice. Email opt-ins don't cover SMS, and SMS opt-outs ("Reply STOP") must be honored immediately, with no delays and no extra steps. For businesses running follow-up across both channels, that means a single opt-out signal should stop everything, including the channel it arrived on.

For teams automating lead follow-up, the practical takeaway is simple: build the opt-out so it works on the first try, and make it permanent. CallMyLeads treats opt-outs as immediate and automatic across channels, which is the standard the research points to.

Stop paying for leads you never get to talk to. Every new lead answered in seconds, 24/7/365, with consent and opt-out handled the way the rules require.

Cross-Channel Consistency: Email vs. SMS

Getting someone to opt in to your emails doesn't buy you the right to text them. The law treats email and SMS as separate channels with separate consent requirements, and mixing them up is one of the fastest ways to land in trouble.

Email opt-ins do not cover texting. Practitioners in the SMS compliance space stress that text messaging requires its own opt-in that names the channel, describes what you'll send, and sets expectations for how often. Consent also doesn't transfer when lists get bought, sold, or shared, so a contact who agreed to emails from someone else still hasn't agreed to hear from you by text.

The opt-out timelines diverge sharply, too. Under the CAN-SPAM Act, you have up to 10 business days to honor an email unsubscribe request, and the unsubscribe link itself must stay live for at least 30 days after the send (UnsubCentral's CAN-SPAM overview). SMS gives you no such grace period. When someone replies STOP, your system must honor it immediately, with no delays and no extra steps.

The penalties run hot on both channels. A single violating email carries maximum FTC exposure of up to $51,744, and the agency hit Experian Consumer Services with a $650,000 civil penalty in 2023 for a non-functional opt-out mechanism (LashBack's enforcement alert). On the texting side, TCPA violations run $500 to $1,500 per message, which adds up quickly when a nurture sequence keeps firing after a STOP.

Here's where cross-channel compliance tends to break down for small businesses:

• Treating an email opt-in as blanket permission to add someone to a text list
• Honoring an email unsubscribe but leaving the contact active in SMS sequences
• Letting a coupon or promo slip into a transactional text, which changes the compliance classification
• Relying on manual list updates instead of automated suppression across every channel
• Buying or sharing lists and assuming prior consent travels with the contact

Channel-specific consent and channel-specific opt-outs are the rule. A contact who unsubscribes from texts should stay on your email list only if they opted in there separately, and vice versa. Each channel needs its own consent record and its own suppression list.

This is exactly why automated opt-out handling matters. At CallMyLeads, every lead response system we run honors opt-outs immediately and automatically across email, text, and call, so a STOP on one channel never gets overridden by a nurture sequence on another. Manual tracking across channels is where small oversights creep in, and those oversights compound into real liability fast.

Automated Compliance for Lead Nurture

Automated lead nurture is where unsubscribe law gets dangerous. A human marketer sees an opt-out request and stops sending. A nurture sequence just fires the next email in the chain, and if nobody wired the opt-out signal into the system, that email still goes out. That's how companies end up violating the CAN-SPAM Act without anyone on the team ever deciding to.

The Experian enforcement action from August 2023 shows exactly how this plays out. The FTC levied a $650,000 civil penalty because consumers weren't given a clear, working way to unsubscribe. Worse, the company told recipients they would "continue to receive notifications" even after preference updates, a pattern regulators treat as circular messaging: the opt-out exists on paper, but the messages keep coming anyway.

The law gives you a 10-business-day window to honor an email opt-out, and the unsubscribe mechanism has to stay functional for at least 30 days after each send. But here's the practical reality: if you wait the full 10 days while a five-email nurture sequence keeps running, you've sent four or five more messages to someone who already said stop. Each one carries penalty exposure of up to $51,744 per violating email. The math gets ugly fast.

So the fix is structural, not procedural. Your system needs to hard-stop every channel the moment an opt-out signal arrives. That means:

• An unsubscribe click or STOP reply suppresses the entire contact, rather than a single message type.
• Nurture sequences check suppression status at send time, in addition to when the contact enters the sequence.
• Email, text, and call channels share one suppression record, so opting out of one doesn't leave the others running.
• No "you may still receive important updates" messaging after an opt-out. That framing is what drew the FTC's attention in Experian's case.

The same logic applies to how you label automated messages. Regulators use a "primary purpose" test, so an email marked as an account notification that also contains a promotional offer triggers full opt-out requirements. Mixing a coupon into an appointment reminder changes your legal obligations whether you realize it or not. Audit your templates for this before enforcement audits them for you.

There's also a deliverability cost beyond fines. Broken opt-outs drive spam complaint rates up, and complaint rates damage sender reputation and inbox placement for every message you send afterward. Persistent senders who ignore opt-outs can face cease-and-desist orders or a full shutdown of operations. Continuing to email someone who asked you to stop also reads as desperate to the recipient, which is the opposite of what nurture is supposed to accomplish.

This is why we built CallMyLeads' nurture follow-up to run "until they book or opt out," with opt-outs honored immediately and automatically across every channel. Speed wins leads, but respecting a stop signal protects the leads you haven't lost yet. If you're running automated follow-up on not-ready-today leads and want it handled right, stop paying for leads you never get to talk to: every new lead answered in seconds, 24/7/365, with compliance built in. Reach us at [email protected].