ToS can't trump the actual law.

It is one thing to make a law, it is another to enforce a law.

The actual law is typically so weak and spineless that the ToS doesn't need to trump it. Particularly when it comes to data security or privacy.

Ok, but it can collect consent

LOL

Legislators are cheap to purchase