It is illegal, but compliance is not enforced to the degree that it should. Companies get away with a lot of GDPR infractions, unfortunately.