Data and direct marketing services company CDMS, which carried out the study, urged companies to pay full attention to the legislation before enforcement test cases start to be launched.
The EU Directive on Privacy and Electronic Communications became law in December 2003 and it requires that companies only send unsolicited sales messages via email to non-customers if they have actively opted in to receive them.
Ian Hubbard, director of CDMS, warned that companies which are not complying are putting out the message that they do not care about privacy legislation.
"This effectively puts them in the category of junk emailers," Hubbard said.
"At the very least, these companies need to put processes in place to stop the rot, and limit their current risk. In addition, there is a major forensic and clean-up job to be done on these companies' marketing databases."
If you have an opinion on this or any other issue raised on Brand Republic, join the debate in the Forum.
This article was first published on brandrepublic.com