Of course. They are a regulated company following regulated rules. You shouldn't expect less.
so regulation now is synonymous of privacy violation?, you can't have both, but there must be in between a way to follow to avoid issue with either one
like for example do not track all customers, but just those that you believe are not 100% honest citizens...