Without permission yes, if it stores it (but that would probably just be client-side). If it stores it and uses it for matters different than what explicitely

Without permission yes, if it stores it (but that would probably just be client-side). If it stores it and uses it for matters different than what explicitely advertised when you consented to it, than yes it's even worse. edit: just saw that's a service they resell. So yeah it is against GDPR