GDPR requires affirmative and explicit consent to data-sharing. I am not a lawyer so I'm happy to be corrected by someone who has more regulatory knowledge here, but I am reasonably certain this company would not be allowed to operate this way in Europe.
