This is actually illegal under GDPR.