That's often worth an FTC complaint for a CAN-SPAM Act violation: https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business https:/

That's often worth an FTC complaint for a CAN-SPAM Act violation: https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business https://www.ftc.gov/business-guidance/resources/can-spam-act... The FTC wouldn't accept "we didn't want to deal with GDPR" as an excuse for a business violating that law.