Yes. They SHOULD. So how did they do that without throwing away their privacy promise or running afoul of the privacy laws?
Second, they could provide users with permission toggles of what users want to share and what not. Same as iOS/Android do now for contacts, location access, etc.