Facebook (probably) has logs of data access, i. e. the API calls third parties have made. But, unless there are any security bugs in Facebook's code being expl

Facebook (probably) has logs of data access, i. e. the API calls third parties have made. But, unless there are any security bugs in Facebook's code being exploited, each and every API call is legitimate, prima facie. The issue with Cambridge Analytica, for example, was with unauthorised retention and sharing of data, as well as its use for purposes not covered by the API access agreement. These circumstances cannot be detected from the logged data alone.