These things have not been legal since the GDPR went into effect, and in some countries even before then.
To be compliant with the GDPR, the US needs data laws which only affects citizens on their own soil and not overreaching to EU citizens.
These things have not been legal since the GDPR went into effect, and in some countries even before then.