It depends. There’s 2 different methods that I don’t think they’re doing that would make it legal:

1. Explicitly tell the user what data the anti-cheat collects when you install it, and what other companies have access to it.

2. Anonymize the data. Crop the screenshots in storage media to just the game screen, and have a list of which games need what sections of the screen blurred to remove usernames.

The first is far more useful for them than the second, but it also undermines it’s functionality ad an anti-cheat because you’re telling the cheat creators what to guard against.

Of course, the real answer here is stop doing user-side anti-cheat at all, do it server-side, and trust nothing the client says. That’s more difficult than user-side, but it also has the benefit of working, while also respecting the user’s privacy.