I wonder if what these companies are (not) doing is actually a crime under the European personal data protection laws?