I seems to me it's a grey zone because too many of the big players are still profiting from user profiling.

Possibly. But it's one of those grey zones that are probably stricter for small companies than they are for bigger ones. Microsoft and Google can easily throw a few million bucks in the direction of their lawyers to make such problems magically go away (and earn those millions back in a matter of hours). I somehow doubt that Bod has the same options...

my point - admittedly badly expressed - is that the mail providers are the first to blame if they don't protect their users better, and laws should be stricter here.

Cheers Rolf
_{(addicted to the 𐍀𐌴𐍂𐌻 Programming Language :)
Wikisyntax for the Monastery}