That's not necessarily true. The legality of this varies largely from country to country. In case of the US, that depends on the state, with the majority of states allowing it, if I recall correctly.
EDIT: just checked, at least 37 US states allow it. The EU is different, since they have union-wide data protection regulation that prohibits it, but the rest of the countries are split. Countries like India, Sweden, or Japan allow it; countries like Canada, Australia, or the UK prohibit it. Case by case basis.