The only penalty here is being banned for a ToS violation. Maybe they could sue for fraud or something? That doesn't change who owns the data.