GDPR requires that he should be able to refuse them if he cares about privacy. Although if he cares about privacy, what is he doing in other people's home?