Do they do this in the EU? This is clearly not GDPR compliant, unless they get the customer's consent at every step.