Block, the parent company of point-of-sale service Square, was found to sell access to customers’ email inboxes who had their receipts emailed to them from a Square system, according to an investigation conducted by Protocol. However, privacy experts concluded the practice does not necessarily violate data protection laws. However, it’s a legal gray area with loopholes buried “deep within” companies’ privacy notices allowing companies like Block to send marketing emails.