Could this be illegal? I mean the EU for example has pretty strict requirements on what you can do with user information.