Question: Many companies I have registered with or interacted with sign me up to their email newsletters without my providing my consent.

For example, I created an account using my email and hired a bike from a bike sharing company through their app. Now I am on their email newsletter.

Does the company have the right to send me marketing emails based on the fact that I purchased something from them even though I didn't give my explicit consent for my data to be processed in that way?

Is consent assumed for every kind of processing/communication based on one reason (a purchase or making an account)? Can I withdraw my consent for marketing specifically?

Answer: 
Under the GDPR, consent is not the only legal basis that allows processing of your personal data. Other legal bases such as *legitimate interest* exist as well. So the question is: does the company have a legitimate interest to send you these emails?

The answer is that this case is more about direct marketing, less about personal data. The circumstances under which direct marketing emails can be sent are covered by the ePrivacy directive, which is implemented in the UK via PECR (Privacy and Electronic Communications (EC Directive) Regulations 2003).

PECR and ePrivacy introduce a concept known as *soft opt-in*:

> 
> where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46/EC, the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details when they are collected and on the occasion of each message in case the customer has not initially refused such use.
> 
> 
> (ePrivacy Directive, Art 13(2))
> 
> 
> 

In plain language, they are allowed to send unsolicited marketing emails to existing customers, under the following restrictions:

* this only applies to customer relationships
* the marketing must be for similar products or services
* you must be able to object to further messages, i.e. unsubscribe
* upon collection of contact details you were given the opportunity to opt out
GDPR is not the right framework [anti-spam](https://www.salesfusion.com/resource/international-email-spam-laws-know-comply/) laws are
-------------------------------------------------------------------------------------------------------------------------------------

Details vary, for example, you do not need permission to send marketing emails in the US but you do in Australia and in both jurisdictions you must provide an easily accessible opt-out.