“Facebook had a “Verified Apps” program & claimed it certified the security of participating apps. It didn’t. Facebook promised users that it would not share their personal information with advertisers. It did.”