If the application behind the login contains personal data, it's even non GDPR compliant.