It's a civil offense, but that's different from it being legal. It just means that it's up to the company itself to sue you to collect any damages, and government enforcement bodies aren't going to touch it.

The issue most ToU violations have with enforcement is that it's hard to show damages. If you just accessed their service with a fake name or downloaded some data for personal use, you haven't really harmed the company. So what are they gonna do, spend $10M to sue you for $0? So they just handle it internally by banning your account and discontinuing your use of the service.

But if, say, you did a DDoS attack that caused an outage costing them $100M, or you did large-scale scraping to set up a competitor that puts them out of business, and they can identify you, they absolutely will come after you in court for that money. The economics is different: now the damages they show is much more than the cost of litigating the case.

No. ToU is a part of contract law. Basically the website is providing a service for you. In exchange for your use of that service, you agree to be bound by the terms. This implicitly creates a contract between you and the website, with the terms laid out by the ToU. This sort of implicit contract is legally controversial - normally for a contract to be valid there needs to be affirmative signatures from both parties, as well as consideration (money) exchanged. In the U.S. at least, "click-wrap" (where you must affirmatively click "I agree") and "scroll-wrap" (where you must scroll through the whole ToU before the product unlocks) ToUs are generally considered enforceable, but "sign-in wrap" (where creating an account binds you) and "browse-wrap" (where there's a ToU link) are very dubiously enforceable. But we're talking about Google here, and they make you click through the ToU and say you agree whenever you unbox a new Android device or create a Google account, and then have it apply to all usage of Google services.

Enforcement can be quite challenging because typically if you provide a service over the Internet you don't have any idea who is using it beyond their IP address and any registration data they provide, but this also means that when companies do have a known violator and can show significant monetary damages, their legal departments come down like a ton of bricks.