Really strict data privacy laws with a regulatory environment that doesn't play games and heavily leans towards consumer rights. In Germany at least, you're also required to obtain double opt-in and record extensive documentation of the entire opt-in process just for email marketing. If you overstep your bounds and draw the attention of regulators in Germany, it has all the comfort of the Eye of Sauron staring at you[2].

[1] https://blogs.oracle.com/marketingcloud/email-marketing-clar...

[2] Lord of the Rings reference. Most apt description I can think of for the dread that comes at the mere thought of pissing off German regulators in this area.