[WhiteSource1]

If you can identify personal data (which if they can tie it to the user's Facebook account, that's pretty easy to do) it's likely (note: not a lawyer) a violation of the EU GDPR regulations (http://www.eugdpr.org/)

[daenney]

Unfortunately GDPR enforcement is about 9 months away. I don't think it applies retroactively.