I have this notion that GDPR says you have to tell people what data you're collecting and why. This would apply wether or not you have an account. This clearly isn't happening.
Also, only the necesary data should be collected (by default) to enable the service to be provided (to the individual). If they don't have an account, or are not logged in ... then Facebook isn't providing a service ... and so shouldn't be collecting ANY data.
Biting the hand that feeds IT
