This is a class action lawsuit waiting to happen. Wouldn't be surprised if the EU pick up on it and decide to hold them accountable for privacy violations.