It's legal because there's no laws on the books because it's assumed that no reputable company would do something like this without their customers being outraged and walking. Unfortunately every tech giant is either doing this or putting their toe in the water of including spyware in mainstream services. shits gonna get a lot worse before people get mad enough to force change and make it better.