FB would have to not give personally identifying info (PII) to the app in the first place. The main reason apps (from a user's perspective) need PII are 1) Disp

FB would have to not give personally identifying info (PII) to the app in the first place. The main reason apps (from a user's perspective) need PII are 1) Display it to you or someone else in the app, or 2) perform a calculation or action on it (e.g. send a text to a phone number, or display an add to women age 20-28). If all I have is a user ID, FB can make it possible to do both without ever access PII. For #1: PII could be embedded using an iframe and a url. You could even pass data (such as templates) in with url params For #2: FB would expose endpoints that allow actions (such as send this email to the user). They could make it as generic as they needed, up to running arbitrary code on a VM, minus networking calls.