They are allowed to look at you and take notes and sell them.
Frankly I can't figure out why stalking a single person is illegal but stalking a billion people is considered good business.
Nope, they just have to want it to stop :)
The specific scenario isn't the point - but the fact that a semi-obvious scenario could be incorrect sorta is. Regulations are complex and tech has a terrible history of playing fast and loose with regulations so it's not like an imposition of regulations would be inappropriate or unwarranted - there are good and bad apples, and the bad apples spoil the bunch.