Home 零对冲(ZeroHedge)每日HackerNews

24小时健身无法让你取消营销垃圾邮件，所以我自己解决了。
24 Hour Fitness won't let you unsubscribe from marketing spam, so I fixed it

原始链接: https://ahmedkaddoura.com/projects/24hf-unsubscribe

## 24 Hour Fitness 无法使用的退订链接 24 Hour Fitness 因其营销邮件中持续无法使用的退订链接面临潜在法律问题，这个问题早在2019年就被报告。点击该链接会显示西班牙语错误信息，源于与OneTrust同意管理平台通信时，JavaScript代码中关于内容类型标头的一行错误——讽刺的是，OneTrust是一家专注于法规遵从的公司。 尽管该问题于2025年11月被报告，并提供了简单的修复方案，但至今仍未解决，导致作者收到了超过40封不想要的营销邮件。这违反了CAN-SPAM法案，该法案要求提供可用的退出机制，类似违规行为的近期罚款已达数百万美元。 作者对持续不断的无关营销“精神攻击”感到沮丧，因此自行构建了一个可用的退订页面作为替代方案。他们呼吁24 Hour Fitness的工程团队中的某人实施这一行修复代码，并为所有用户解决该问题。

一名 Hacker News 用户“daem”报告修复了 24 Hour Fitness 营销邮件中失效的退订链接。据称该公司阻止用户选择退出垃圾邮件。 评论区的讨论引发了对退订链接有效性的担忧， “imiric” 认为公司经常只是为了满足法律要求而使用它们，甚至可能使问题恶化，潜在地将数据出售给更多的垃圾邮件发送者。 “imiric” 提倡一种更强大的解决方案：使用自定义电子邮件域名，并为每个公司创建唯一的地址。这样可以在收到不需要的电子邮件时轻松阻止发件人，从而完全绕过不可靠的退订流程。 另一位用户“mattlondon” 指出 24 Hour Fitness 的设置可能存在服务器端安全问题（CORS）。
相关文章
原文

24 Hour Fitness has a broken unsubscribe page. You get one of their marketing emails. You click the unsubscribe link at the bottom. It takes you here:

https://www.24hourfitness.com/members/unsubscribe

You enter your email. You click unsubscribe. You get a mysterious error message in Spanish.

I found the bug. It's one line of JavaScript. I reported it back in November 2025. No response. So I built my own unsubscribe page.

24 Hour Fitness unsubscribe page showing an error message in Spanish

"The audacity of a Spanish error message on a US gym website." — Claude

What the heck is this? 🤔

Error de conexión al obtener el token de OneTrust.

OneTrust is an American software company that develops privacy, security, and data governance software. Their platform includes tools for consent management and regulatory compliance automation.

The irony: OneTrust is literally a consent management platform focused on regulatory compliance, and 24 Hour Fitness is using it to violate consent regulations. The error is in Spanish for some reason.

This is actually illegal

The CAN-SPAM Act requires commercial emails to have a working opt-out mechanism. Companies that violate this face serious fines:

  • Verkada: $2.95 million (2024) - the largest CAN-SPAM penalty ever. They ignored opt-out requests.
  • Jumpstart Technologies: $900,000 (2006) - didn't process opt-out requests in time.
  • Experian: $650,000 (2023) - spammed users with emails they couldn't opt out of.

Each individual email can carry a penalty of up to $53,088.

Marketing email = psychic attack

I don't subscribe to anything. Not newsletters. Not Substacks. Not even blogs from writers I deeply care about. My inbox is for communication, not marketing.

I'm definitely not subscribing to 24 Hour Fitness marketing spam.

Since October 2025, I've received 40 marketing emails. Every single one links to the same broken unsubscribe page.

Each of these emails is a psychic attack. An attack on my attention. Here are the subject lines:

I'm paying for this membership. I can't opt out of their spam. This is evil.

This isn't new for 24 Hour Fitness

I found this Reddit post from February 2019:

Reddit post from 2019 complaining about 24 Hour Fitness unsubscribe

Almost 7 years ago, same problem.

24 Hour Fitness has had unsubscribe problems for at least 7 years. Not only do they make it hard to cancel your gym membership, they also make it hard to escape their marketing emails.

I hope they fix this. If I'm dealing with it, I'm sure thousands of others are too.

I reported it. No response.

I submitted a bug report via their contact form back in November 2025.

They replied: "Thank you Ahmed, for reaching out! We will make sure your comments are forwarded to the appropriate person. Please be assured we are doing our best to follow up as soon as possible, typically within 10 business days."

Weeks later. No response. Bug still broken. Emails still coming.

The one-line JavaScript fix

I looked at their code. The bug is embarrassingly simple:

$.ajax({
    type: "POST",
    url: m.urlPost,
    data: JSON.stringify({...}),
    contentType: !1,  
    ...
})

contentType: false tells jQuery to skip the Content-Type header. The server expects JSON. It rejects the request.

The fix:

contentType: "application/json"

One line. Broken for months.

So I built my own unsubscribe page

My page calls the same API with the correct header. It just works.

If you know someone on the 24 Hour Fitness engineering team, please share this with them. It's a one-line fix.

联系我们 contact @ memedata.com