It’s EU’s GDPR.
Anything like a newsletter or marketing must be opt-in. And it cannot be bundled with other consent, that is they can’t refuse to provide you a service if opt-in isn’t absolutely necessary.
To be honest, not sure if any other countries have such laws.
I’d prefer fuck-you-fines making it impossible to ignore the security that are actually enforced.