The actual law is typically so weak and spineless that the ToS doesn't need to trump it. Particularly when it comes to data security or privacy.

It is one thing to make a law, it is another to enforce a law.

Ok, but it can collect consent

LOL

Legislators are cheap to purchase