That would be the Computer Fraud and Abuse Act[0,1]. The relevant bit is "Whoever ... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ... information from any protected computer ... shall be punished as provided in subsection (c) of this section." A "protected computer", by the way, is any computer "which is used in or affecting interstate or foreign commerce or communication."
That's not relevant, though, because US v. Lori Drew[2] decided that a user can't be prosecuted under the CFAA for breaking a ToS agreement. (BTW, IANAL.)
0: http://www.law.cornell.edu/uscode/text/18/1030
1: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
2: https://wikispaces.psu.edu/display/IST432TEAM24/United+State...