It's my understanding that those websites are in violation of the gdpr for doing so.