If you've never signed up for Facebook, they still have a file on you. Your friends uploaded their contacts — Facebook has your phone number and email. You visited a website with a Facebook tracking pixel (30% of all major websites have one) — Facebook knows. You used an app with Facebook's code inside it (a third of top Android apps) — Facebook knows. A Belgian court ordered them to stop. They told the US Senate they don't do this. Both things can't be true.
critical
A quiz app collected data on 87 million people through their friends without asking. Facebook knew about it for over two years and did nothing. That data was used to manipulate voters in the 2016 US election and Brexit. When journalists were about to break the story, Facebook threatened to sue the newspaper. Mark Zuckerberg testified before Congress, said 'I'm sorry' 98 times, and Facebook's stock went UP 4% during his testimony. The total bill: $5.9 billion in fines. Nobody went to prison.
critical
The United Nations said Facebook helped cause a genocide. In Myanmar, Facebook WAS the internet. The military used fake Facebook pages to spread hatred against the Rohingya people. Human rights groups warned Facebook for four years. Facebook didn't act. Thousands of people were killed. Facebook's hate speech detection in the local language was described as 'abysmally poor.' A genocide survivor is now asking the SEC to investigate Meta for lying about what happened. This is not a privacy violation. This is a company that was warned its platform was being used to organize mass murder and chose not to invest in stopping it.
Meta's defence is that kids shouldn't be on Instagram. Their age check is a birth date field where a 12-year-old types '2005.' A judge said design problems aren't protected by Section 230. Schools in 19 states are suing because Instagram affects children's ability to learn.
critical
Meta added a 'Take a Break' reminder. The algorithm pushing harmful content to vulnerable teens still runs. States had to pass laws because Meta wouldn't fix it. Those laws don't start until 2027.
critical
In September 2022, a UK coroner ruled that Instagram contributed to the death of 14-year-old Molly Russell. She had viewed thousands of posts about self-harm and depression — content Instagram's algorithm actively recommended, pushing increasingly graphic material to a child. Coroner Andrew Walker said the content "shouldn't have been available for a child to see." Meta said it had updated its policies. Molly's father Ian Russell said the platforms "helped kill my daughter." A coroner officially ruled a social media company helped kill a child, and Meta's response was past tense: we already fixed it.
Your phone number is your WhatsApp identity, visible to everyone you chat with. It links your messaging to your real name, bank account, and government records.
critical
WhatsApp told 3.3 billion people their messages were end-to-end encrypted — meaning nobody, not even WhatsApp, could read them. Texas's Attorney General says that was a lie. The state filed suit in May 2026 alleging Meta kept internal access to those "private" conversations the whole time.
critical
Meta employees and Accenture contractors could read your "private" WhatsApp messages. Not sometimes. Not accidentally. A class action says they had broad, systematic access to conversations that 3.3 billion people were told "not even WhatsApp" could see.
Meta says eye tracking just makes VR work better, but their own executive admitted it could measure whether you look at ads. The companion app includes Meta's advertising toolkit. Your eye movements — what catches your attention, how long you look at things — could feed the same ad-targeting system as Facebook and Instagram.
critical
Meta markets the Quest 3 as privacy-focused, but they're currently under a $5 billion government penalty for lying about privacy — and got caught violating that agreement. When a company fined billions for privacy violations says their new product with cameras, microphones, and eye trackers is "built with privacy in mind," their history suggests otherwise.
critical
Meta says children can't use eye tracking, but researchers found kids under 13 using the headset in almost every VR game they checked — without proper child accounts. These kids are being recorded by cameras, microphones, and room-mapping sensors without their parents' knowledge or consent. Meta's child safety controls only work if children actually use child accounts, which they clearly don't.
Meta told Congress that Messenger messages are private. In 2022, a Nebraska mother and her 17-year-old daughter were charged with illegal abortion — and the key evidence was their Facebook Messenger conversations, which Meta handed to police with a search warrant. The daughter was sentenced to 90 days in jail and two years probation. Meta complied with 76% of all government data requests in 2023. "Private" means "private until a detective asks."
critical
Meta told parents their kids could only chat with approved contacts. A bug let strangers in. Meta didn't tell anyone publicly. The FTC found they lied about parental controls.
high
Meta kept your Messenger conversations readable for over a decade while their other app (WhatsApp) had encryption since 2016. They chose ad revenue over your privacy for seven extra years.
Threads' own App Store privacy label — which Meta itself filled out — discloses collection of health data, financial information, precise location, contacts, browsing and search history, purchases, and "sensitive info." Top10VPN found Threads collects 45% more data points than X. When asked, Meta's deputy privacy officer said the label "isn't fully representative." They're right — it's worse than it looks. You signed up to post short text updates. Threads wants your health records, bank activity, and precise GPS coordinates.
critical
Meta launched Threads in 100+ countries in July 2023 — except the entire European Union. The reason: GDPR. Threads collects "sensitive information" under special EU protection, and European courts had already struck down Meta's "legitimate interest" excuse. The app was so invasive that Meta's own lawyers said "not in Europe." They launched there five months later with modifications. If a product is too invasive for the company's own legal team to defend in court, what does that tell you about using it everywhere else?
high
In December 2025, Meta started using everything you say to its AI chatbot to target you with ads — not just on Threads, but Facebook and Instagram too. Ask Meta AI about anxiety? Expect mental health ads. Mention a vacation? Travel ads everywhere. Privacy groups filed complaints. In the US, there's no simple opt-out — you navigate what experts called "labyrinthine" settings. Meta isn't reading your DMs. They're doing something more efficient: turning your AI conversations into an advertising profile.
Hospitals installed Facebook's tracking pixel on their websites. It sent your medical appointment bookings, the conditions you searched for, and your doctor's name directly to Facebook. Crisis hotlines sent call logs. Tax sites sent income data. The website operators had no idea. Facebook's code collected everything the page contained. Your cancer diagnosis, sent to an advertising company via a tracking pixel.
critical
A priest was tracked to gay bars using mobile data from the ad-tech ecosystem. The data came from app SDKs — the same infrastructure Facebook SDK, Google Analytics, and ad networks feed. His Grindr usage was cross-referenced with his phone's location. He was outed. He resigned. The data that destroyed his career started as "anonymous app analytics."
high
$5 billion fine. The largest privacy penalty in history. Facebook's SDK in third-party apps continued collecting data even when users had turned sharing off. The privacy settings were a placebo. The SDK ignored them. Five billion dollars says Facebook knew and did it anyway.