Well, for one, he's not gathering explicit consent anywhere. Just because there's a privacy policy and controller information at the bottom of the page doesn't mean I explicitly agree to have my data used for any purpose.