If you told the average web-using person that whenever they visit google.com Google gets to know which internet provider you use and from which country, possibly even city you come from and which language you speak, they'd probably freak out thinking it was some evil Google scheme to mine data when in fact, all that is simply a byproduct of any reasonable logging or analytics solution that is not special to Google at all.
If that's true -- that an objective reasonable observer would think those things -- perhaps that's indicative of analytics being of questionable ethical standing.
After all, they enable the massive centralization of extremely far reaching user data, voluntarily submitted by both applications and websites to centralized data brokers -- such as Google -- who are not only positioned to build enormous commercial profiles of users, but also to (be compelled to) give or sell those profiles to government(s).
The fact that "phone state" is mixed up with Phone Unique ID is terrible.
Read phone status and identity: Allows the app to access the phone features of the device. This permission allows the app to determine the phone number and device IDs, whether a call is active, and the remote number connected by a call.
https://play.google.com/store/apps/details?id=com.facebook.k...
And don't worry if your friend has the Facebook app and calls you if you don't have a profile. They can just search through your friend's contacts to associate your number with a shadow profile of you anyway.
If the user puts some effort into parsing it, they will understand it and what it means for their privacy. But most people will not put that much effort into installing an app.
Despite being perfectly clear to you and I, it is wrong to ask for these permissions at install time.
Imagine if every time you visited a web site you were given a list of 5 - 10 permissions requested by the website before you could visit.