@withaveeay @mookie @vmstan We still have the remains of the GDPR, which means
1) they have to use the least personal data possible
2) they have to detail what personal data they use, for why and for how long.

Having DDG'd their privacy policy document, https://octopus.energy/policies/privacy-policy/ does not list gender as one of the things slurped, therefore they're in breach of the GDPR.