In the US personal data generally has 0 protections with a handful of exceptions like medical information. As the FTC's statement reads, the only possible issue

In the US personal data generally has 0 protections with a handful of exceptions like medical information. As the FTC's statement reads, the only possible issue here is Facebook violating their own privacy policy (stated as a privacy 'promise') and the consequence there will be at worst a very gentle slap on the wrist. If not for the media coverage of this, Facebook would be unable to care any less. The media coverage though is driving the stock prices down and effect the company many orders of magnitude more negatively than any legal enforcement will.