403
Marketing should always be OPT-IN by default, but these extra steps to opt out is truly asshole design.
Oh, and on the opt-out confirmation screen, you get two options: Yes or No. The button colour for "yes" is white, and the “no” button matches the “save” button on the previous screen, so it's easy to accidentally cancel the opt-out. Double-asshole design!
I got the same thing, and I suspect this is their "malicious compliance" way of dealing with some new rule about needing to let people opt out of marketing. There are 33 separate settings.
At least now I can probably leave their app's notifications enabled for 2FA without also getting marketing notifications.