I don't think this can even fly under GDPR