Here is how it works in France:
http://www.cnil.fr/english/data-protection/rights-and-obliga...
Practically, if you operate a service in France, you need to have 2 checkboxes at user creation:
* I accept to receive commercial informations and advertising from the service
* I accept to receive commercial informations and advertising from third parties
If you don't have the checkboxes or the user unchecked, no sharing.