Yes, but in the EU this would be illegal.

https://www.privacy-ticker.com/decision-to-fine-the-norwegia...