I thought that was pretty open? Even their more privacy-oriented Zero Data Retention agreement (which isn’t so easy to get on your business account) includes an exception “where needed to comply with law or combat misuse”