IIRC, CAN-SPAM explicitly says the unsubscribe button needs to be available without logging in. So this would be a violation.

So, who do you contact about that violation?

Here you go: https://www.justice.gov/action-center/report-spam

You can probably guess how effective that is. In practice, unless you can get the FTC or a state attorney general to sue an actual company for you, nothing will ever come of it.

I report spam that I'm unable to unsubscribe from to the FTC via their online page[0]. I've never gotten any response but it does seem to work. I've been dropped from several marketing lists after reporting them to the FTC, and it's unlikely that these marketers decided on their own to remove me from their lists.

[0] https://reportfraud.ftc.gov/#/

Especially if your account is no longer accessible; a problem I had with Uber after changing my phone number. Bombarded with "Uber Eats" spam and no way to unsubscribe without going through some kind of ridiculous process to reactivate the account.

I have that problem with a former utility company that keeps sending updates about the business that I've unsubscribed from multiple times. The one that irks me the most is TP-Link Kasa who has a marketing opt-out in the account creation flow and they still send repetitive spam without honoring the unsubscribe link.

Or needing to enable javascript to unsubscribe.