I mean... that's a clear GDPR violation[0] if it's in the UK or EU. Do we know if this is still happening, and if so, how do we get the ICO involved in this?[1]

[0] https://ico.org.uk/for-organisations/guide-to-data-protectio...

[1] The EU GDPR sets a maximum fine of €20 million (about £18 million) or 4% of annual global turnover – whichever is greater