It’s mostly passive tracking of network traffic.

That data seems as much the recipient's data as the sender's or of any system capable to observe transport. If I see someone go down the street & stop somewhere, is that traffic observation really their data? The internet protocol wasn't built for privacy of that layer of activity.

data could be further compromised depending on

A protocol disclosing data as designed is compromised? Are we talking about (1) actually compromised systems permitting unauthorized access to data or (2) services working as designed & getting data per usage agreement?

Legal definition

Theft is the taking of another person’s personal property with the intent of depriving that person of the use of their property.

If we're talking about (2), then how is that theft?