The EU was tired of giant Internet companies collecting tons of consumer data and then misusing it. To fix this issue, they created the GDPR. It is a set of new EU regulations that specify exactly how companies should manage personal data. Therefore, everything that complies with GDPR is legal. If the data collection and data processing is under the applicable law and is compliant with the General Data Protection Regulation (GDPR), it is legal.