I'm not sure if it is illegal since the US expends a lot of energy keeping privacy rights out of its civil rights.. But it would be a chore to process gdpr requests from dual citizens, etc.