What are the legal implications of doing this based on jurisdiction? There are also ethical considerations. I expect this to be another thing which will be an 'open secret' in the tech/marketing worlds until other people find out about it and will be upset about.