So, in a GDPR world, it is true that you need to get more explicit user consent for the gathering of this permission. However, I think it's overly dramatic to say "illegal for all good use cases" and criminal for others. These tools have been used for years in the EU, with signoff from lawyers and regulators when PII is being obfuscated or removed.