It is made illegal. As the post notes, you need to (1) give notice and (2) data collected needs to be made available in a user access request and (3) deleted irrevocably on request. You must have a legitimate reason to process and store this data (scattershot forwarding to everyone is a prima facie violation). Unless you comply with all of these, you are in violation.