It's not exactly that hard to imagine. I've thought about a solution like this for 2 separate products across 2 different companies, and it was separately rejected for ethics concerns both times. You'd be surprised what company decided to reject it in the first case. This is an abuse of web APIs to achieve targeted data monitoring of users and probably a severe violation of GDPR.

Any European residents want to confirm this is happening with them?