And they are certainly allowed to do ranking. But they can only do it on non-PII data, on data that has been deliberately made public, and on data which people have consented to its collection and storage with unequivocal opt-in.