The practice has been very controversial in the EU ever since GDPR took effect.

It’s simply that nobody has been sued to the end for it yet.