There is no one solution that handles everything (or else everyone would just do that). It is always about a mixture of multiple methods.

Is it even legal?

This is the internet. Someone will always claim it is illegal in "Europe". Nobody will care enough to verify one way or the other. And, regardless of whether it is or is not, companies don't care because most of those regulations are very toothless either due to bureaucratic inertia or just not giving a fuck.

The fact of the matter is that this is a very common model used by a range of services and it is not going to get challenged any time soon.