I worked there in 2016-2017. I was a Data Engineer so I was pretty close to this. It was taken very seriously, to the point it was annoying (tables with PII get

I worked there in 2016-2017. I was a Data Engineer so I was pretty close to this. It was taken very seriously, to the point it was annoying (tables with PII get anonymized, which then means extra work, etc). Also, the sheer amount of effort that went into this [the tooling/infra that was already there for this when I arrived] was impressive. I'm not claiming FB couldn't have / can't do a better job, you can always do a better job, hire even more people for this, etc. But it was definitely taken very seriously, much more seriously than you'd think from all this bad press. And if you go and work there, you'll be impressed, I guarantee that. However, what I'm talking about is data protection, the problem here was that app permissions were explicitly too loose [until 2015]. As I said, I also think this was a bad policy, and people are rightly upset. But there's way too much generalization happening in this thread.