They shouldn't be allowed, and they aren't allowed. Actually the new digital services act [0] is shaping up to clarify these, but IIRC there have also been first cases decided in courts.

[0]: https://edri.org/our-work/the-eu-parliament-takes-strong-sta...