Facebook

SOCIAL & MESSAGING

LAST UPDATED 27 AUG 2026

OF 100

PARANOIA SCORE

WHAT THE POLICIES SAY

Facebook (operated by Meta Platforms, Inc.) discloses in its Privacy Policy that it collects, uses, and shares user information across its Meta Company Products and with partners and service providers, and its corporate structure — including Meta Platforms Ireland Limited and dozens of U.S. and international subsidiaries — is disclosed in SEC filings. The platform's regulatory record includes a 2019 FTC $5 billion settlement over prior privacy-control violations, a 2023 record-setting €1.2 billion GDPR fine from Ireland's Data Protection Commission over EU-U.S. data transfers, and a 2021 exposure of scraped data from roughly 533 million accounts.

TRACK RECORD

2 BREACHES · 1 ENFORCEMENT ACTION

BREACH LEDGER

[2023-10-01] · BREACH

Have I Been Pwned lists a breach record for Facebook: "Facebook Marketplace".

Approximately 77,267 accounts affected, per HIBP.

Exposed: Email addresses, Geographic locations, Names, Passwords, Phone numbers, Social media profiles.

haveibeenpwned.com ↗

[2019-08-01] · BREACH

Have I Been Pwned lists a breach record for Facebook: "Facebook".

Approximately 509,458,528 accounts affected, per HIBP.

Exposed: Dates of birth, Email addresses, Employers, Genders, Geographic locations, Names, Phone numbers, Relationship statuses.

haveibeenpwned.com ↗

Breach data: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0

ENFORCEMENT

[2019-07-24]

In July 2019, the FTC announced that Facebook would pay a $5 billion penalty and submit to new privacy restrictions and a modified corporate structure to settle charges that it violated a 2012 FTC order by deceiving users about their ability to control the privacy of their personal information.

ftc.gov ↗

TIMELINE

NO ENTRIES ON FILE YET.

ULTIMATE PARENT

TOOLS WE RECOMMEND

PLUS

RECEIPTS

16 ON FILE

COLLECTION

The service's policy indicates your personal data is used for advertising purposes.

facebook.com ↗

COLLECTION

The service's policy indicates this service claims that your personal data is not being sold.

facebook.com ↗

[2023-01-01] · COLLECTION

An earlier version of the Meta Privacy Policy (effective January 1, 2023) states that Meta explains how it collects, uses, shares, retains, and transfers information across its products.

facebook.com ↗

[2025-12-16] · COLLECTION

Meta's Privacy Policy states it references specific information categories, directing users to a section explaining what information is collected for each category, across Facebook, Instagram, and other Meta Products.

facebook.com ↗

[2021-05-26] · OWNERSHIP TRANSPARENCY

As assessed by PrivacySpy on 2021-05-26: Will affected users be notified when the policy is meaningfully changed? — Yes.

facebook.com ↗

[2023-02-01] · OWNERSHIP TRANSPARENCY

Exhibit 21.1 to Meta Platforms, Inc.'s Form 10-K lists the company's subsidiaries, including "Meta Platforms Ireland Ltd. (Ireland)" and various Facebook-branded U.S. entities such as Facebook Operations, LLC and Facebook Holdings, LLC, disclosing the corporate structure underlying the Facebook service.

sec.gov ↗

[2025-01-30] · OWNERSHIP TRANSPARENCY

Meta Platforms, Inc.'s Form 10-K for fiscal year 2024, filed with the SEC, discloses that the company was incorporated in Delaware in July 2004 and that its Class A common stock trades on Nasdaq under the ticker "META," identifying the publicly traded parent entity behind Facebook.

sec.gov ↗

[2019-07-24] · SHARING

In connection with its 2019 settlement, the FTC described a pre-2019 Facebook privacy setting under which information a user limited to "friends" could nonetheless be shared with the developers of apps that those friends used.

ftc.gov ↗

[2021-05-26] · SHARING

As assessed by PrivacySpy on 2021-05-26: Does the policy allow personally-targeted or behavioral marketing? — Yes.

facebook.com ↗

[2025-12-16] · SHARING

Meta's Privacy Policy discloses that information collected is shared both internally across Meta's offices and data centers and externally with partners, third parties, and service providers as part of global data transfers.

facebook.com ↗

[2026-02-21] · SHARING

The service's policy indicates this service informs you that its Privacy Policy does not apply to third-party services.

mbasic.facebook.com ↗

[2026-07-25] · SHARING

A Blacklight scan of https://www.facebook.com on 2026-07-25 observed 5 third-party hosts contacted while loading the site.

themarkup.org ↗

[2019-07-24] · TRACK RECORD

ftc.gov ↗

[2019-08-28] · TRACK RECORD

As documented in PrivacySpy's incident history on 2019-08-28: Data Breach — More than 540 million records about Facebook users were [publicly exposed](https://www.cbsnews.com/news/millions-facebook-user-records-exposed-amazon-cloud-server/) on Amazon's cloud computing service, according to a cybersecurity research firm.

cbsnews.com ↗

[2019-09-05] · TRACK RECORD

As documented in PrivacySpy's incident history on 2019-09-05: Exposed Phone Numbers — In the latest privacy scandal for the tech giant, hundreds of millions of phone numbers linked to Facebook accounts were [exposed](https://techcrunch.com/2019/09/04/facebook-phone-numbers-exposed/) on a server without authentication. Some of the records also included personal information such as the user's name, gender, and country.

techcrunch.com ↗

TRACKING TECH

Facebook's Apple App Store privacy label discloses that Contact Info, Identifiers, and Other Data collected by the app may be used to track users across apps and websites owned by other companies.

apps.apple.com ↗

DATA SOURCES

ToS;DR

CC BY-SA · TOSDR.ORG ↗

PrivacySpy

CC BY · PRIVACYSPY.ORG ↗

Have I Been Pwned (haveibeenpwned.com)

CC BY 4.0 · HAVEIBEENPWNED.COM ↗

Claims are summarized from these sources and may be edited from the original. Text adapted from a CC BY-SA source is shared under CC BY-SA.

LAST REVIEWED 2026-08-27 · METHODOLOGY v1.7