Just because its hidden in the fine print instead of explicitly disclosed at the point of collecting the email address does not make it "okay."

It might make it legal but that's not at all the same thing - a defense that falls back on legality means they have an adversarial relationship with that customer which generally means they've lost any future business from them. That's the last place a smart company wants their customer relationship to end up.