Are there audits to check compliance?
FB used 2FA phone numbers for spying, after repeatedly promising that they will be not used in this way.
See also FB promises about WhatsApp during merger.
Is there a truly independent confirmation?