Hacker News Reader

Say they don’t do it secretly. They put up signs that they are doing it.

Do they have to get explicit consent from each customer and save that info for audits?

No, they claim it under legitimate interest for fraud prevention and have a data deletion schedule.