I highly doubt anything similar is happening in Europe, since GDPR requires freely given consent, and is rather specific about what does and does not count as f

I highly doubt anything similar is happening in Europe, since GDPR requires freely given consent, and is rather specific about what does and does not count as freely given. (Remember this the next time you find those GDPR popups obnoxious.) In Germany specifically, it's likely that operating such a database wouldn't just involve fines for the company, but also criminal penalties for the people involved. Especially if they continued after the data protection authorities became aware of this and told them to stop.