Who is auditing if the data is anonymized?

It is, as FB will automatically get at least the IP address, date and time which is seen as PII under GDPR.