It looks like they were fined for that. https://arstechnica.com/tech-policy/2019/07/ftc-fines-facebook-5-billion-imposes-new-privacy-oversight/ https://arstech

It looks like they were fined for that. https://arstechnica.com/tech-policy/2019/07/ftc-fines-facebook-5-billion-imposes-new-privacy-oversight/ https://arstechnica.com/tech-policy/2019/07/ftc-fines-facebo... > Additionally, the FTC said Facebook violated the earlier order by "misrepresenting" consumers' ability to opt out of facial recognition by using phone numbers provided for two-factor authentication for advertising purposes without notifying users and by storing user passwords without encryption.