If it's got any data protection impacts, it is illegal in Europe under the GDPR. However its enforcement is significantly lacking even against very obvious and blatant breaches, so anything slightly more subtle has no way of being addressed.