It's not legal. It's just not rigorously enforced.

It was promised that things get better with the proposed ePrivacy regulation. Let's see.