That's what I love the EU GDPR for. By law no one is allowed to use my number without explicit consent in the first place. And if someone spammed me, they have to tell where they got my data from and have to delete it upon request. Love it!
That is the law in the usa also. Any cell contact, from a business to an individual, without a preexisting business relationship, is illegal via the TCPA. But that's never actually enforced, so...
Yes it is. There's a whole industry of baiting spammers and then suing them.