“In the [Aleksandr] Kogan case, people signed into that app expecting to share the data with Kogan, and then he turned around and, in violation of our policies and in violation of people’s expectations, sold it to a third-party firm.”