I seems to me it's a grey zone because too many of the big players are still profiting from user profiling.

Possibly. But it's one of those grey zones that are probably stricter for small companies than they are for bigger ones. Microsoft and Google can easily throw a few million bucks in the direction of their lawyers to make such problems magically go away (and earn those millions back in a matter of hours). I somehow doubt that Bod has the same options...