With regards to the the findings, I think that'd be the wrong part of the GDPR. The issue is that applications are immediately sending user data to FB without a

With regards to the the findings, I think that'd be the wrong part of the GDPR. The issue is that applications are immediately sending user data to FB without authorization through the FB SDK - it's possible that many of the application developers don't actually have anymore information on you than indicated in the application and/or agreements. You'll need to ask about their data processors I think.