Violating gdpr is apparently legal. But even having opt out instead of opt in is in violation