GDPR says: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." in its preface. https://eu

GDPR says: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." in its preface. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Anyway, flimsy legitimate interest excuses are easiest to override. You just object to data processing, then it's upon the other side to provide overriding reasons why their legitimate interest is more important than your "interests or fundamental rights and freedoms" of which right to object to data processing is one. Almost nobody even tried to pass that hurdle when I objected to data processing. And those few that did try, I just sent them the decision to fine for almost identical situation (where a company tried to claim legitimate interest for mining data from public registries and sources and publishing them on a website) from my country's DPA. And that made them comply too.