That's a rhetorical question I hope? In case it isn't: yes, that's against the GDPR that requires that when data is collected the purpose of the collection is stated and consent is obtained for the use of the information for that purpose. No consent->violation of the law.