This looks like another use of data not following the original purpose of the collected data. Clearly it should be illegal to use any such data without asking every single user whose data they want to use for consent. And by that I do not mean some extortion scheme.