It's perfectly legal if you install a device the owners fully agreed to install and signed a 3-days long licensing text explicitly saying it that they didn't bother to read. Which is exactly what Facebook is doing.