They must, otherwise Facebook wouldn't freak out so much on the anti-tracking notices.

I routinely limit location on apps - as well as address book, microphone and camera.