> Is this even legal under GDPR?

I guess you could always complain about it to your country's data protection watchdog and then we'll all find out?