Without regulatory oversight and third party auditing of certified access logs, you can't really be sure what was or was not accessed. Of course, if you imposed

Without regulatory oversight and third party auditing of certified access logs, you can't really be sure what was or was not accessed. Of course, if you imposed those kind of requirements on Facebook, that would take a significant amount of resources and therefore reduce their profit margins. Probably not very investor-friendly.