This is why I mentioned that the sale is not (e.g.) $5 per user. But if someone has access to 1000 users' data and pays $5000 for that access, well, it's kinda

This is why I mentioned that the sale is not (e.g.) $5 per user. But if someone has access to 1000 users' data and pays $5000 for that access, well, it's kinda the same thing. Auditing such process is a joke. No such audit will ever exist, as the results would be documented and leave a trail of misappropriation and abuse (of data). The only audits 'allowed' by the business would me the innocuous ITGCs. I invite anyone from FB with audit related experience to comment (please use a TA account and be as vague as you can to prevent tracing).