GDPR would prohibit this, and since they never ask about consent, I would assume that they have no legal basis to collect personally identifiable information on

GDPR would prohibit this, and since they never ask about consent, I would assume that they have no legal basis to collect personally identifiable information on anyone. If you have evidence of the contrary, I would love to know.