This would be a violation of GDPR and CCPA and would expose them to massive litigation liability.