Yes, it probably does violate the GDPR. At least the European Data Protection Board thinks so, see https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion...