Who decides what is legal and what not? Is it even legal for an ISP in the US to monitor your traffic or to act like this without a court order on behalf of a s

Who decides what is legal and what not? Is it even legal for an ISP in the US to monitor your traffic or to act like this without a court order on behalf of a shady company? I don't get it that nobody is protesting about this...