This is pretty certainly a violation of GDPR in that case.
https://commission.europa.eu/law/law-topic/data-protection/r...
Reply on news.ycombinator.com