Ah, sorry, the paragraphs in [3] I'm looking at are

21 - For the claim that there was public reporting that Facebook was presumably aware of in 2019.

26 - For the claim that in February 2021 Facebook refused to review and destroy the data they had collected from Flo to that date, and thus presumably still had and were deriving value from the data.

I can't say I read the whole thing closely though.