Highly illegal. In the USA I guess you can sue.

In EU these would be fucked by GDPR.