Obviously they'll get away with this in the US, but doesn't this break a LOT of EU privacy laws?