Picture this phrase: ”You can do it if you have the permission”. What does it bring to your mind? Something that parents would say to their little child or something written in the law-book?
Unfortunately it’s both. Because today such an absurd application is found regarding legislation of use of personal data. I don’t know how did it happen, probably due to heavy lobbying of some organization and companies. But it’s there anyway.
The irrationality is not only juridical but also in common practice. How do you prove you have a permission to do something from an individual? A signed documents at notary, legalized by apostille? That would do it yes, but it would also be extremely expensive and difficult to do, when you have data from thousands of people.
So the other way (and most common way) to do it? You all know it: gather users IP and time-stamp. But what does it proof actually? That you know users IP and put some random date? The person will still not remember he signed up for your offer, so after some time, you might get an email from him, with a line ”why are you spamming me?”. Then you send him the IP he used, only to find out, that it’s not his real IP anymore, because: his home/office IP is not static (as it’s usually not), he moved out or he signed up from WiFi in a coffee shop etc. Now you can’t prove anything. And even if you did have his true IP, he can still complaint to government person data protection agency, to your ISP (hosting company) or to some spam fighting organization, and in most of the cases they will believe him (even without the proof), and not you.
So you did everything right, but still got into troubles, why? Well, because the law is absurd and it’s very difficult to enforce an absurd law.
You may ask, but how many would actually go through the trouble of complaining over some ads they received just because they forgot if they signed up for newsletter or not? Then I will ask you how many complain over so-called ”real” spam (because often you cannot tell the difference between spam and not spam). The answer to the both questions is the same: Not many, and it’s those people you would not want to be your clients anyway, because they are complainers by nature and be always unhappy and picky no matter what you do.