Why is that wrong? In the vast majority of cases (at least in Europe) they don't. Now we have the GDPR it's even more difficult.