This study aims to reveal digital surveillance practices by examining the user agreements and privacy policies of Instagram, WhatsApp, Facebook, and X through a descriptive content analysis method. While data collection, user consent, and sharing processes are structured as a legitimacy framework, responsibility and risks are largely placed on the user. The vague and ambiguous expressions in the agreements grant platforms broad discretionary powers while making it difficult for users to anticipate the use of their data. As a result, user agreements and privacy policies function as key tools that render digital surveillance invisible and legitimize it through user consent. These findings reveal that surveillance practices are supported not only by technological mechanisms but also by legal and discursive processes.