Facebook/myspace/twitter etc etc.
They all sell your information and sometimes depending on the EULA/Clause, picture are fair game. So regardless of whether or not the chick gave her consent, it is most likely legal because she agree to terms and conditions when making an account.

