Facebook ignored compliance at the time, but the way they mitigated the risks was by targeting a smaller, exclusive market (smaller colleges in the US) that's less risky compliance-wise (no minors for instance, domestic market).