No it’s not legal, but the attacker hides behind privacy protection