If GDPR is a concern, it has to be opt-in, so it wouldn't be compliant in any case.