[ChlorophZek]

could this be a GDPR violation of any sort in the EU?

[MatthewWilkes]

I should think so. They don't have consent; vital interest, public task, legal obligation and contract do not apply; they must be relying on legitimate interest. I can't imagine this would pass an unbiased balancing test.