I stand corrected. Seems to be legal as long as you don't violate standard data privacy laws.