Facebook who have the ability are not necessarily criminal. It is the websites that invite them into a secure context that are often illegal. In the physical

Facebook who have the ability are not necessarily criminal. It is the websites that invite them into a secure context that are often illegal. In the physical realm, is it okay for an advertising company to be invited into a bank safe or customer records storage without any business controls to audit, monitor or check their actions? Same is true on websites.