This might be a silly question, because you know, big companies tend to ignore laws, but this cannot be GDPR (or maybe more importantly for this the California equivalent due to jurisdiction) compliant right?