Laws can and should override terms of service. The question of why it's legal isn't about contracts, but about basic privacy rights enforced (or not) by the legal system.