It's almost certainly illegal but the GDPR is not 100% clear about it and it has literally never been enforced, so most sites are happy to do this because they have plausible deniability and safety in numbers.