About this question
I have just received a message asking to consent to PayPal policy updates from the domain: https://epl.paypal-communication.com
The actual link is full of trackers. Given the domain name, it sounds like a routinely email spoof. Also, visiting the domain, you are welcomed by a "503 Service Unavailable" message.
After some investigations, including whois, the weird domain seems really linked to PayPal.com. That being the case: Why should a company (and in particular a company dealing with payments) send messages from another domain?
Why add countless trackers if you can already recognise users from login?
Should the practice of sending messages from somecompany.com using anothercompany.com become established, it will be virtually impossible for users to tell if a website is legit or a scam.