Tracking users without their consent. This is a crime in the EU. It’s a crime that it’s not a crime in the US.

Unauthorized access to a computer system. I'm sure if I connected to some port on a computer belonging to Meta without them wanting it, that would be the crime I would be charged with. But somehow if Meta connects to a port on my phone without me agreeing to it, it's not a crime?

Spying on users, connecting their real life identities to their browsing history without their consent or knowledge?

stalking? Maybe even something in the ECPA