No way is this going to fly under GDPR. Whatever genius had this idea needs to be held accountable legally for a massive breach of trust. Opt out isn't going to fly in 2018. Collecting money on the behalf of individuals is fine IF they opt in to the service. I imagine this service would have exploded in popularity and been perfectly legal if it was opt in but now.. Yeah.. heads should roll.