I can't imagine this is in accordance with the terms of service nor legal. You need explicit authorization to charge the card, but you don't have it.

Part of our process is to ensure this is covered in the terms and we encourage all merchants to explicitly show this in the product for visibility but also because a significant percentage of customers will add a backup to avoid risk of downtime.