This looks like the perfect time for some of the EU-based influencers to raise a GDPR infringement request against Chtrbox. They collected the geo-location of the people, so the company should've known they would be liable.