You might be referring to some other law than GDPR?
I was referring to the GDPR as pointed out in my comment.
There even is a GDPR recital that explicitly states:
"[...] The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."
Source: https://gdpr-info.eu/recitals/no-47/