Honestly, the enforcement side is where it all falls apart. The CAN-SPAM Act in the US hands oversight to the FTC, but they've got fewer staff than a medium-sized agency's support desk. A single complaint about an unsubscribe link going nowhere? That's basically noise in the system. They only act when there's a pattern of fraud or a massive volume of reports-and even then, it's a slap on the wrist unless you're running a straight-up phishing operation.
GDPR's Article 21 gives people the right to object, but in practice, enforcement depends on which DPA you're dealing with. Some are proactive (looking at you, ICO), others are essentially toothless. The real pressure comes from mailbox providers-Gmail, Outlook, Yahoo. Their spam filters quietly throttle or blacklist domains that consistently ignore opt-outs. That's the only mechanism that scales, and it's algorithmic, not legal.
I've dealt with clients who deliberately broke unsubscribe flows because they "didn't want to lose leads." Took a DMARC policy of p=reject and a 70% deliverability drop before they cared. The law is just the theatre, the infrastructure is the actual enforcement. And even that's imperfect-plenty of senders hide behind third-party ESPs and shift blame. So no, the legal requirement doesn't guarantee compliance. It's more like a gentleman's agreement with a poorly resourced referee.