There is a problem here and that is how to stop "users" from spamming the project with marketing garbage. If the "solution" is to collect more personal data from users, e.g., e-mail addresses, mobile phone numbers, multi-factor authentication, etc., as a prerequisite to even submitting a search query, then that is not a solution. It is an additional problem.
Assuming the project is collecting personal data from users, e.g., peoples' search queries, where is the agreement that governs what the project is allowed to do with that data. If there is no agreement, then presumably the project can do whatever it wants.
We can guess what happens next. Search engine as userdata-gathering exercise and commercial entity. Been there done that.