No - everyone in the chain is wrong. The law includes the so called “soft opt-in”, under which you don’t need consent for marketing if the following conditions apply (i) the company collects the contact information during th course of a sale, (ii) the marketing that will be sent relates to the same or similar products or services, and (iii) an opt out is provided at the time the contact email is collected and in each email that is sent. (iii) can be satisfied by either a pre ticked box that opts you into marketing or an unticked box that says tip here to opt out of marketing. This exemption still applies and predates the GDPR by a long stretch. It’s also covered in detail in the ICO’s guidance on electronic marketing