1. Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (ePrivacy Directive).
Reference: Article 13, Paragraph 2. This paragraph explicitly states the rule applies where a person "obtains from its customers their electronic contact details... in the context of the sale of a product or a service..." This is the legal basis for the soft opt-in.
2. Article 29 Data Protection Working Party, "Opinion 5/2004 on unsolicited communications for direct marketing purposes under Article 13 of Directive 2002/58/EC," WP90, 27 February 2004.
Reference: Section III.2.b, page 13. The opinion clarifies that the phrase "in the context of the sale" can include pre-contractual stages, such as when a customer requests information or a quote, which aligns with an "inquiry about buying a product."
3. Kuner, C., Bygrave, L. A., & Docksey, C. (2020). The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press.
Reference: Chapter on Article 21 (Right to object), commentary on the relationship with the ePrivacy Directive. The text explains that the soft opt-in under the ePrivacy Directive is a specific lex specialis rule that requires an existing customer relationship, which begins when details are collected during a sale or sales negotiation.