[crote]

How is that not a massive GDPR violation?

[inigyou]

You can just break the law, if you don't get caught, especially if you're rich.

[alightsoul]

They can just not do it in Europe and keep doing it everywhere else

[tremon]

Profiling visitor traffic to protect against abuse is a legitimate use case, even for GDPR. It's only a violation if that usage is not disclosed in the ToS.