I'm particularly interested in their shady data privacy shenanigans. How would this hold up against a GDPR complaint? It doesn't sound like they're properly listing what data is to be tracked, meaning users are by definition unable to consent, so any amount of data collection is unlawful, no?