ACARS isn't ATC traffic. It's semi-private communications with airline company dispatch. Text-based ATC communications is done over a different system called CPDLC (FANS-1/A).
That said, this is no different than listening to any other unencrypted, non-cellular radio traffic. Totally legal everywhere (except a few rare exceptions, like the UK).
And as I mentioned in my other comment, in the US the ECPA specifically says you can listen to aeronautical radio traffic.
> Totally legal everywhere (except a few rare exceptions, like the UK).
And (after a cursory search) Spain, Portugal, Germany, Austria, maybe France... In other words, legal in some places, illegal in others.
> Text-based ATC communications is done over a different system called CPDLC (FANS-1/A)
ACARS is both an application and a (legacy) lower layer suite of protocols supporting it, but modern ACARS versions and CPDLC can use the same underlying digital channel, as far as I understand (i.e. VDL Mode 2).
As a result, many of these tracking sites can capture both, as well as presumably "legacy/analog" ACARS.
Not sure about the details, but I suspect it's more a consequence of laws on telecommunication privacy from analog days being very generic than a specific intention to make ATC listening illegal. Opt-out vs. opt-in by frequency and/or purpose, essentially.
That said, it's supposedly still being very much enforced against e.g. planespotters at airshows in some places – no idea what the point of that is.
But so were analog mobile phones and pagers, and in some countries, even receiving unencrypted voice ATC radio isn't legal.