Some examples please. In recent memory I can only think of examples where services violated TOS (which I'm not sure how FB could prevent) or got authorization from the end user (as in the Cambridge Analytica case).
Any examples of them leaking data as a result of their own processes?