The GDPR is proof that terms of service isn't exactly a flawless legal barrier. You can't state in a contract that "If you use our service we get to sell your personal life away" because illegalities and rights infringements cannot be inside a contract to begin with.