It should be based on no. of user impacted and avg. impact to each user. Revenue/Margin are should not be primary driver. We don't convict murderer/thief depending on their net worth (if any it is tilted on wrong side).

There is a greater impact to society than measurable direct impact to users. Facebook should be liable for their total net externalities, divided by the probability of being caught for such actions. That is the economic premise of the FTC. This should include fines and remedies for anti-trust violations as well, and since this is an opportunity cost, it does scale with the size of the company.

In fact you should probably subtract the direct costs to users, as there is already a mechanism in place for collecting damages, and any government intervention on this axis should go to something reminiscent of a victim's fund.

This makes no sense. Violating the law should not be a business expense, it needs to hurt. If Facebook was a person the remedy might be jail time, but you can’t imprison a business.

Some jurisdictions do (in Europe, for example).

Just because company is smaller, punishment should be lower? Impact of both leaks on average joe is much different, and size of penalties have it reversed

Look at it from a different angle. The fine to the company should be big enough to make it painful to continue the behavior in question. As such, the bigger the company, the bigger the fine.