Legally they can probably get away with it, since it has happened with other ISPs. The technical reason this doesn't happen is due to your connection a website being encrypted.