Under GDPR this kind of data collection and sharing HAS to be opt-in i.e. with an informed consent. You can’t just bury it in your TOS and/or privacy policy. The user has to be explicitly shown what they are collection, on what basis they are doing it and how they are using it, then give the user the choice to accept and decline that, and they have to respect that decision.