It's a "surprise" only to the extent that Facebook's leaders have been hauled before Congress and promised under oath they value privacy. Or something like that. The insidious thing here is: to the layperson, Facebook has promised to the government to play by some rules, so they must not be doing anything too harmful, or else they'd be in trouble.