For AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.

Risk if broken

A law broken

Applies when

The project it sends email.

How to do it

US law (CAN-SPAM) requires the opt-out to keep working for 30 days after the message is sent. It also bans selling or transferring the address of anyone who opted out, except to comply with the law. Make unsubscribe tokens last at least that long, or never expire. When you change sending services, import the old suppression list into the new one before the first send. A company you hire to send for you does not take over your legal duty. CAN-SPAM also asks marketing mail to say clearly that it is an ad, unless the person agreed to it beforehand. The FTC sets the fine at up to $53,088 for each breaching message. Never add a suppressed address back, as Keep the list clean says.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

JavaScript example

async function suppressByToken(token) {
  const { email, list } = await db.unsubscribeTokens.find(token);
  await db.suppressions.upsert({ email, list, reason: 'unsubscribed' });
}

Python example

def suppress_by_token(token: str) -> None:
    entry = db.unsubscribe_tokens.find(token)
    db.suppressions.upsert(email=entry.email, list=entry.list, reason="unsubscribed")

How to check

A test that moves the clock 31 days past a send shows the unsubscribe link still suppresses the address. After a change of sending service, every address on the old suppression list is on the new one.

Sources

• CAN-SPAM Act, 15 U.S.C. 7704
• FTC CAN-SPAM Act compliance guide for business

Related rules

• Keep the list clean in Email