Gdpr seemed like it was designed to ban this, but lately companies (especially German ones?) seem to be trying this. I guess it won’t be resolved without a big, slow, expensive court case.