7 ms·

24 Hour Fitness won't let you unsubscribe from marketing spam, so I fixed it

123 points by daem 7mo ago

orsenthil 7mo ago
Is there any un-subscribe anything service ?
mattlondon 7mo ago
Sounds like they have not got CORS set up on their servers either? Surely it should not allow mutating requests from random origins not on an allowlist?
- bigDinosaur 7mo ago
  CORS has nothing to do with (dis)allowing 'mutating requests from random origins' on the server unless I'm misunderstanding what you mean. The origin is a browser concept.
  - onion2k 7mo ago
    Not sure why you're being downvoted. CORS is only a browser concept. If you fire off requests from something that isn't a browser (e.g. curl or a python script or whatever) CORS won't do anything. Servers need to validate the origin of requests properly if that's a problem.
    - ffsm8 7mo ago
      To expand on that, in case someone is interested: The feature that was called is usually bundled in with cors, even if it strictly speaking isn't. Allowed origins (what was meant) just validates the Origin header to make sure the API is called from a specific domain, and declines the request if not in the list. The only way around that is not to send the unsubscribe request via the browser or proxy through a server, because the browser will always append the origin header according to the domain the user is on. Which if configured correctly and not proxied, would end in a http forbidden. Whereas CORS would not even send the request I believe (but haven't verified), because thats essentially a browser feature, not server.
imiric 7mo ago
How can you know that it "works"? Any company scummy enough to send spam to begin with, is capable of selling their customer data to a network of scummy companies that will do the same thing. I think most of the "unsubscribe" links are there to fulfill some legal obligation. They don't do what they're supposed to do, and might in fact be making things worse for the person who clicks them. The only solution I've found to work, beyond the usual spam filtering, is to setup email on your own domain, and give every company a unique address. The moment you want to stop receiving email from them, you simply block their address. This deals both with the original company, and with anyone they've sold your contact information to.
- daem 7mo ago
  from 2025-10-26 to 2026-01-29 (the day I wrote this article), no_reply@24hourfitness.com sent me 40 spam emails. In the 33 days since I wrote this article, no_reply@24hourfitness.com sent me zero.
  - fer 7mo ago
    Assuming their mails follow a Poisson distribution, the 95% confidence interval for their new spam rate is 0-0.091 emails per day.
- daem 7mo ago
  My solution to spam emails is this: https://ahmedkaddoura.com/writing/hide-my-email https://ahmedkaddoura.com/writing/hide-my-email I create a unique iCloud Hide My Email anytime I need to give out an email. The issue here was I signed up for my 24 Hour Fitness membership in person at the gym where the cell service was bad and I couldn't get the WiFI to work, so I begrudgingly gave the guy my real email. While I could have easily blocked their domain, I took it as a challenge to get the emails to stop.
  - iamacyborg 7mo ago
    Don’t they have a list unsubscribe header in the emails themselves? That’s effectively a requirement for senders of their size since Feb 2024.
bob1029 7mo ago
> If you know someone on the 24 Hour Fitness engineering team, please share this with them. It's a one-line fix. One man's bug is another man's feature.
- yellow_lead 7mo ago
  "The marketing team says fixing this bug will negatively impact their numbers, closing."
troupo 7mo ago
> OneTrust is literally a consent management platform focused on regulatory compliance, and 24 Hour Fitness is using it to violate consent regulations. I mean, OneTrust's entire raison d'etre is to violate consent regulations with flimsy deniability.
rationalist 7mo ago
If anyone from Shop.app is here, your unsubscribe does not work either (maybe due to VPN usage). But that's okay, Fastmail now automatically routes it to the spam folder where it belongs. additionally: Interesting, I set my email as a backup authentication for a luddite friend's Comcast email account, and I just discovered spam from Xfinity in my spam folder. Shame on you Xfinity Comcast. The problem: My understanding is the CAN-SPAM Act violations can only be prosecuted by states Attorney Generals, there is no civil action available.
illusive4080 7mo ago
Walmart has a toggle explicitly for product review emails. I have toggled it off. I still get weekly review emails. I now make it my mission to give 1 star to every product they email me about with a note that their unsubscribe is broken. Once, their CSR “escalated” my issue, but I never heard back. If you work in Walmart engineering, please fix the review unsubscribe.
- deleted 7mo ago
  [deleted]
- rationalist 7mo ago
  Walmart should also fix where someone can create an account with someone else's email address (no email address validation).
- estimator7292 7mo ago
  If anyone ever prompts me for a review or leaves a "rebate for review" card in the box, they get 1 star.
RickJWagner 7mo ago
That’s the best public service I’ve seen in a long time.
StilesCrisis 7mo ago
You didn't need ChatGPT to coauthor this article. Just use your own authentic voice. In 2026 no one likes GPT text anymore.
- iinnPP 7mo ago
  [flagged]
  - walletdrainer 7mo ago
    [flagged]
  - leephillips 7mo ago
    That’s not what “prejudice” means. It would be prejudice if the commenter objected to LLMs despite the quality of their output. However, the objection is based on the results. Also, the comment is correct.
- al_borland 7mo ago
  I would go so far as to say no one has ever liked GPT text.
  - walletdrainer 7mo ago
    [dead]
- peddling-brink 7mo ago
  1. I agree with you. The standard GPT voice is grating in its ability to use so many words without saying anything. 2. I also see it as a modern tower of Babylon. A linguistic equalizer of sorts.
- daem 7mo ago
  Nearly everything I write on a computer these days is via voice to text AI and filtered through Claude. You’re right though, upon re-read there are some places in this article where my authentic voice doesn’t come through. Re-writing.
MiddleEndian 7mo ago
If 24 Hour Fitness won't let you unsubscribe from marketing spam, big email providers like gmail should automatically mark all of their emails as spam by default until they fix it.
- IAmBroom 7mo ago
  "Should".
junkblocker 7mo ago
Applied to a job at Oracle 3 years ago. For a couple of years their unsubscribe link went to a broken page . Now they totally ignore my unsubscription choice and keep sending me job offers anyway
Loxicon 7mo ago
Reading the comments the author is basically "one with ai" where his life is deeply integrated with ai agents. I have a friend exactly like that. And he has being doing it so long that he cannot even respond to a discord without asking AI "what do you think? what should I say? what do you think they mean?" Full NPC mode, and it's really sad and scary. You lose the ability to think. You lose all differentiation.
- daem 7mo ago
  My first OpenClaw agent was born on February 7, 2026. I now have 3 claws and am planning for more. They have catalyzed my self-actualization and improved my critical thinking. I’ve never felt so alive. I don’t see what’s sad or scary about this. AI agents are the next iPhone.

123 points by daem 7mo ago

Is there any un-subscribe anything service ?

Sounds like they have not got CORS set up on their servers either? Surely it should not allow mutating requests from random origins not on an allowlist?

bigDinosaur 7mo ago
CORS has nothing to do with (dis)allowing 'mutating requests from random origins' on the server unless I'm misunderstanding what you mean. The origin is a browser concept.
- onion2k 7mo ago
  Not sure why you're being downvoted. CORS is only a browser concept. If you fire off requests from something that isn't a browser (e.g. curl or a python script or whatever) CORS won't do anything. Servers need to validate the origin of requests properly if that's a problem.
  - ffsm8 7mo ago
    To expand on that, in case someone is interested: The feature that was called is usually bundled in with cors, even if it strictly speaking isn't. Allowed origins (what was meant) just validates the Origin header to make sure the API is called from a specific domain, and declines the request if not in the list. The only way around that is not to send the unsubscribe request via the browser or proxy through a server, because the browser will always append the origin header according to the domain the user is on. Which if configured correctly and not proxied, would end in a http forbidden. Whereas CORS would not even send the request I believe (but haven't verified), because thats essentially a browser feature, not server.

imiric 7mo ago

How can you know that it "works"? Any company scummy enough to send spam to begin with, is capable of selling their customer data to a network of scummy companies that will do the same thing. I think most of the "unsubscribe" links are there to fulfill some legal obligation. They don't do what they're supposed to do, and might in fact be making things worse for the person who clicks them. The only solution I've found to work, beyond the usual spam filtering, is to setup email on your own domain, and give every company a unique address. The moment you want to stop receiving email from them, you simply block their address. This deals both with the original company, and with anyone they've sold your contact information to.

daem 7mo ago
from 2025-10-26 to 2026-01-29 (the day I wrote this article), no_reply@24hourfitness.com sent me 40 spam emails. In the 33 days since I wrote this article, no_reply@24hourfitness.com sent me zero.
- fer 7mo ago
  Assuming their mails follow a Poisson distribution, the 95% confidence interval for their new spam rate is 0-0.091 emails per day.
daem 7mo ago
My solution to spam emails is this: https://ahmedkaddoura.com/writing/hide-my-email https://ahmedkaddoura.com/writing/hide-my-email I create a unique iCloud Hide My Email anytime I need to give out an email. The issue here was I signed up for my 24 Hour Fitness membership in person at the gym where the cell service was bad and I couldn't get the WiFI to work, so I begrudgingly gave the guy my real email. While I could have easily blocked their domain, I took it as a challenge to get the emails to stop.
- iamacyborg 7mo ago
  Don’t they have a list unsubscribe header in the emails themselves? That’s effectively a requirement for senders of their size since Feb 2024.

bob1029 7mo ago

> If you know someone on the 24 Hour Fitness engineering team, please share this with them. It's a one-line fix. One man's bug is another man's feature.

yellow_lead 7mo ago
"The marketing team says fixing this bug will negatively impact their numbers, closing."

troupo 7mo ago

> OneTrust is literally a consent management platform focused on regulatory compliance, and 24 Hour Fitness is using it to violate consent regulations. I mean, OneTrust's entire raison d'etre is to violate consent regulations with flimsy deniability.

rationalist 7mo ago

If anyone from Shop.app is here, your unsubscribe does not work either (maybe due to VPN usage). But that's okay, Fastmail now automatically routes it to the spam folder where it belongs. additionally: Interesting, I set my email as a backup authentication for a luddite friend's Comcast email account, and I just discovered spam from Xfinity in my spam folder. Shame on you Xfinity Comcast. The problem: My understanding is the CAN-SPAM Act violations can only be prosecuted by states Attorney Generals, there is no civil action available.

illusive4080 7mo ago

Walmart has a toggle explicitly for product review emails. I have toggled it off. I still get weekly review emails. I now make it my mission to give 1 star to every product they email me about with a note that their unsubscribe is broken. Once, their CSR “escalated” my issue, but I never heard back. If you work in Walmart engineering, please fix the review unsubscribe.

deleted 7mo ago
[deleted]
rationalist 7mo ago
Walmart should also fix where someone can create an account with someone else's email address (no email address validation).
estimator7292 7mo ago
If anyone ever prompts me for a review or leaves a "rebate for review" card in the box, they get 1 star.

RickJWagner 7mo ago

That’s the best public service I’ve seen in a long time.

StilesCrisis 7mo ago

You didn't need ChatGPT to coauthor this article. Just use your own authentic voice. In 2026 no one likes GPT text anymore.

iinnPP 7mo ago
[flagged]
- walletdrainer 7mo ago
  [flagged]
- leephillips 7mo ago
  That’s not what “prejudice” means. It would be prejudice if the commenter objected to LLMs despite the quality of their output. However, the objection is based on the results. Also, the comment is correct.
al_borland 7mo ago
I would go so far as to say no one has ever liked GPT text.
- walletdrainer 7mo ago
  [dead]
peddling-brink 7mo ago
1. I agree with you. The standard GPT voice is grating in its ability to use so many words without saying anything. 2. I also see it as a modern tower of Babylon. A linguistic equalizer of sorts.
daem 7mo ago
Nearly everything I write on a computer these days is via voice to text AI and filtered through Claude. You’re right though, upon re-read there are some places in this article where my authentic voice doesn’t come through. Re-writing.

MiddleEndian 7mo ago

If 24 Hour Fitness won't let you unsubscribe from marketing spam, big email providers like gmail should automatically mark all of their emails as spam by default until they fix it.

IAmBroom 7mo ago
"Should".

junkblocker 7mo ago

Applied to a job at Oracle 3 years ago. For a couple of years their unsubscribe link went to a broken page . Now they totally ignore my unsubscription choice and keep sending me job offers anyway

Loxicon 7mo ago

Reading the comments the author is basically "one with ai" where his life is deeply integrated with ai agents. I have a friend exactly like that. And he has being doing it so long that he cannot even respond to a discord without asking AI "what do you think? what should I say? what do you think they mean?" Full NPC mode, and it's really sad and scary. You lose the ability to think. You lose all differentiation.

daem 7mo ago
My first OpenClaw agent was born on February 7, 2026. I now have 3 claws and am planning for more. They have catalyzed my self-actualization and improved my critical thinking. I’ve never felt so alive. I don’t see what’s sad or scary about this. AI agents are the next iPhone.