Absolutely. Contact information is provided with certain expectations of how it will be used. If I provide an email address for the purpose of receiving packa

Absolutely. Contact information is provided with certain expectations of how it will be used. If I provide an email address for the purpose of receiving package tracking updates, it is absolutely unacceptable to use that email address for marketing. If I provide a phone number for 2FA (ignoring all the security flaws in that), it is absolutely unacceptable to use that phone number for marketing. Misappropriating personal information for unapproved purposes is on the same level as misappropriating credit card numbers for unapproved purchases. Just because an entity has access to information does not mean that they are justified in using that information in any way possible.