First, CAN-SPAM doesn't outlaw the sending of unsolicited commercial messages - on the contrary, it lays out rules for sending them. Second, in this case, at some point this guy agreed to receive emails from Criteo when entering his email address somewhere. The fact that people don't read TOS before they agree to them does not invalidate them.