gdpr
Can I sue a company for testing Captcha when unsubscribing from email?
<p>With all the data protection stuff these days I was wondering if it is possible to sue a company for making a user pass a <a href="https://en.wikipedia.org/wiki/CAPTCHA" rel="nofollow noreferrer">CAPTCHA</a> test when unsubscribing from email. </p>

<p>I don't know the law surrounding this issue but the user experience is horrendous: </p>

<p>I get an email that I don't want from a company I don't really care about into my personal inbox. They provide a link below, as legally mandated I believe, for me to be able to unsubscribe from their mailing list. I am directed to an external URL where most companies quickly confirm the saved preferences. Why should I need to pass a CAPTCHA when an email was clicked directly from my inbox? This is mostly hypothetical right now, but I am wondering if there are any laws (e.g., GDPR) that would make this actionable.</p>

<p>According to <a href="https://econsultancy.com/10-rules-for-getting-email-unsubscribes-right/" rel="nofollow noreferrer">10 rules for getting email unsubscribes right</a> on Econsultancy, the GDPR says of unsubscribing (my emphasis):</p>

<blockquote>
  <p>There is no specific rule about how companies should allow unsubscribing from email, but the General Data Protection Regulation (GDPR) does state that <strong>removing consent should be as easy as giving it</strong>. This means that if businesses try to make it difficult or confusing they may find themselves receiving complaints.</p>
</blockquote>

<p>So, assuming they do not <em>otherwise</em> hinder unsubscribing in some of the ways described on that page, would having to pass a Captcha test stop unsubscribing being <em>as easy as</em> signing up?</p>

<p>Obviously, it can depend on exactly how you sign up. Some processes may have involved a Captcha test in the first place, or validating your email to activate an account: in such cases, it feels like a clear draw. Even if all that was involved to sign-up was to enter your email-address on a web-page, then passing a single Captcha test doesn't really sound like a significant difference.</p>

<p>Also, much as I hate "defending" companies that try to flood you with emails, there are some practical reasons for including something like a Captcha test. In your question you say "<em>when an email was clicked directly from my inbox</em>". However, they don't necessarily <em>know</em> it came directly from your inbox:</p>

<ul>
<li><p>Depending on the format of the link, it may be possible for a mischievous third-party to spoof requests to the unsubscribe page. A Captcha helps ensure a human actually did the clicking.</p></li>
<li><p>Even if the format of the link is "encoded" in a way to make it "spoof-proof", it is known that <em>some</em> email clients might "pre-visit" links they find in emails (see, <a href="https://stackoverflow.com/q/43443947/2096401">How to stop e-mail clients from visiting links in e-mail automatically?</a> on StackOverflow). One of the reasons for doing this, I believe, is to help protect users from dangerous links in "phishing" and similar emails. However, it can also mean that without <em>some</em> kind of secondary confirmation (e.g. Captcha), people could get unwittingly auto-unsubscribed by their email client.</p></li>
</ul>

<p>Overall, I would say that a Captcha alone is <em>not</em> sufficient to hinder the unsubscribing process to the point you can hit them with things like GDPR, especially as there are some practical justifications for including one.</p>
