It's literally the only spam I get on my phone.
I have been a part of multiple companies trying to make a "harmonized" global opt-in policy: basically figure out any set of marketing preferences where we could get away with collecting information without first knowing the user's country - even if that meant more conservative marketing opt-ins.
In each case, we could never figure out a single-method for collecting explicit opt-in that worked worldwide. The standout countries always being some combination of South Korea, Germany, Russia, or Brazil.
E.g., recruiter spam, in particular. And I don't mean of the "are you interested in this job?" variety. I mean in the "can we hawk some candidates to you, that you can hire and they pay us for?" variety.
I am not involving in candidate sourcing in my company, period. These emails are directed to me, individually. Some claim to be American companies, and seem to have a "legit" web presence, if shady marketing tactics, and some seem to have no web presence and seem super shady, e.g., "we index heavily on the intangibles/DNA of a candidate; their Intelligence (EQ/IQ)". No mailing address, no unsubscribe link, no prior consent, all of which TFA claims CAN-SPAM requires.
"Survey" requests (American, no unsub link, no mailing address in email, no prior consent), "zero trust cloud access" company (American, no mailing address in email, no prior consent), … etc.
For example, "Legitimate Interest" can be used if there is a reasonable way that the usage could be foreseen like sending a "How did we do" email after somebody buys something. Unfortaunately, this is not well-defined in the regulations so, for example, one company I came across got my information from Linked In, sold it to other businesses and those directly contacted me to sell something on the basis that the vacuuming company had a "legitimate interest" in selling my data i.e. it's how they made their money.
I think the issue is here that GDPR is a fairly poorly written cudgel of a law, and regulators are really only using it to go after larger foreign tech companies. Smaller, local companies can get away with much more malfeasance because it would be such a pain to enforce.
The big notable cases are against large tech companies, but most of the fines and procedures involve local entities
I imagine that an attribute on my "users" table is not enough?
(But then, I have no idea what places have reasonable rules. I have never seen any with this specific failure for email, but IANAL and I haven't looked much.)
However, if I consent to a User Agreement, do you really think they keep a copy of the specific version of the User Agreement I accepted?
They sign up, then you send them an email and track when they hit the “I approve” link.
