Up until now companies have been getting away with this because of "user agreements." Nobody has had the money and interest to get them in court.
I don't see any possible way this survives a lawsuit, for exactly the reason you said. This is almost certainly not legal but nobody has had a reason to get precedent to say it until now.