As far as I know, they are. And, since I don't have a Facebook account, I can't find a way to submit a GDPR subject access request.