Actually Apple and Google should not allow this in their app store policy. An 3rd party SDK sending data if it’s not needed should be a BIG no-no....I expect at least Apple to require this.
There are probably thousands of other apps that have the same problem.
Hard in the general case, but I'll bet it's trivial to scan for the Facebook SDK, or any other blacklisted libraries, unless they're intentionally obfuscated.
There are probably thousands of other apps that have the same problem.