[jankovicsandras]

Is this illegal in GDPR countries (EU + Norway + ...) or am I reading GDPR wrong?

"If informed consent is used as the lawful basis for processing, consent must have been explicit for data collected and each purpose data is used for"

https://en.wikipedia.org/wiki/Gdpr

[Signez]

There is no personal data collected as it's one of the key feature of that process, so in my humble opinion it's out of the scope of GDPR.

[jankovicsandras]

"Controller and processor Data controllers must clearly disclose any data collection, declare the lawful basis and purpose for data processing, and state how long data is being retained and if it is being shared with any third parties or outside of the EEA."

I don't see the word "personal" in this sentence, only "any data collection". It's clearly not in the users' interest/benefit to activate this data collection, and not required for the normal functioning of the browser/websites. So activating this silently is minimum _very unethical_ and probably illegal, but I'm not a lawyer.