It is not illegal to spy on users, you just need to call it "metadata".
And as long as it has a warrant for one individual + multiple hops from that person you potentially legally sweep up hundreds/thousands of other innocent people's information - often full bore, not just metadata.
Isn't there a consistent history of shady practices from such companies, like purposely ambiguous language in the Android location activity preferences, or similar stuff from Facebook when they try to make you share more data with them like contacts?
So the answer is that I would trust that it (mostly) doesn't happen if the legal terms say it won't.