You’re right that what they collect and what what they use it for should be specified more clearly. I suspect if one carefully read through the 10K word ToS, it

You’re right that what they collect and what what they use it for should be specified more clearly. I suspect if one carefully read through the 10K word ToS, it covers just about everything they do. If it hadn't historically, it will have, since GDPR. Despite the whole media stink about Cambridge Analytica, usage figures aren’t significantly different. This leads me to believe the average user will simply agree to whatever is put in front of them so be able to use checkout pics and read newsfeeds or play farmville or whatever else it is that people do on FB. What the EU could mandate is a max 1000 word ToS, that the more concerned user without legal training could actually grok. The GDPR just makes sure companies cover themselves legally - not that hard, if they can get away with a humongous ToS which almost no one will ever read.