So if someone for example, adds a statement to T&C that as a payment for use of software, the user consents to collecting of a sequence of pressed keys (including 16-digit numbers) and selling them on the black market to whoever is interested, it becomes legal?

Where did I say that?