Facebook should be turned off.
I see Firefox are recommending that you install a special Arsebook sandbox to try to limit the amount of damage Arsebook is going.
Facebook is utterly despicable, and will do all they can to sell your private data, no matter what settings to do. Also, remember anything you mark as private on Facebook is essentially public.
I saw a tool developed in house by one of our security teams, where, using standard Facebook APIs, it can retrieve all the personal details and posts, private or public, of them, and all their "friends", and all their "friends", and all their "friends" and so on. It has always been known that Facebook is desperately insecure, but that was an eye opener, that within seconds, it could get all this privately marked info.
The best thing anyone can do with an Arsebook account, including WhatsApp, is to change all the private info, then "delete" the account (it won't actually delete, just mark it)