It can be argued that spyware's actions constitute theft. Burglary, I suppose, although that depends on the statutory definition. The problem is that the "consent" is rarely, if ever, truly informed.
Try wading through a 6,000 screen EULA to find out exactly what the license says. The waste of bandwidth alone is criminal.