We cannot give "legal" advise ...
It is always a good idea to have some kind of opt out/in process.
Most newsletter extensions - we recommend AcyMailing (and as a paid member you can get a nice discount - see
www.joomlapolis.com/promotions
)
If you only have a small number of users you can also use the CB Mass email function in CB User Manager. You can filter users based on a CB field (which you can use to let people opt in/out).