Hacker News Reader

Couldn't they just put in the TOS that if you create an account or use any of their services then they can just collect all the data they want?

This is against the GDPR. Not that it would be a problem for Facebook - they obviously tried this and it was explicitly ruled illegal.