You can change state with a GET request. You aren't "supposed" to do it but there's no technical barrier preventing an unscrupulous company from effectively using the GET as a POST.
Remember those web counter images that would increment the number displayed each time it received a GET request? They were the most evil. -scary laughter-