Well, as they're officially not used at all in the UK, there's been no need to create any legislation around them, so while this could be an offence under the communications act, you could argue (probably unsuccessfully) that you're actually providing a service to customers by taking their data to protect them from themselves, as they may be terrorists and not yet know it.