They can't without violating (or at least changing) their privacy policy.

You and all your friends are welcome to each bring an arbitration case against them if they have been doing it or if they do it without you agreeing to an updated privacy policy.

If they haven't, then you have nothing to complain about. If they change their privacy policies to allow it, then complain.