I don't think it needs to be illegal – it should be enough to just hold companies responsible for the consequences, just like they are for using any other kind of technical system without appropriate supervision.