We’re in that sort of transitory zone before gdpr enforcement has really kicked in and it’s about to become actually flagrantly illegal to do this

(I hope?)