Isn't this a violation of gdpr? And if it is, how have they not been sued yet?