I guess it depends on whether you view this as a continuum or have an absolute "anything the user touched is user data" take. Compare it to a couple of security

I guess it depends on whether you view this as a continuum or have an absolute "anything the user touched is user data" take. Compare it to a couple of security issues they had last year: First, the one where the attackers would have had full access to the accounts. Photos, posts, private messages, likes, contacts, etc: https://newsroom.fb.com/news/2018/09/security-update/ https://newsroom.fb.com/news/2018/09/security-update/ Or the one where some apps could read photos that they were not given access to, or in some cases that the user hadn't shared at all: https://developers.facebook.com/blog/post/2018/12/14/notifying-our-developer-ecosystem-about-a-photo-api-bug/ https://developers.facebook.com/blog/post/2018/12/14/notifyi...