Without permission yes, if it stores it (but that would probably just be client-side).

If it stores it and uses it for matters different than what explicitely advertised when you consented to it, than yes it's even worse.

edit: just saw that's a service they resell. So yeah it is against GDPR