have always wondered about this especially post Cambridge Analytica where Meta imposed really stringent requirements for API use even for personal things while it was blatantly obvious that internally it was a different story