> I'm assuming it isn't just a matter of grabbing a logo (jpg) from Facebook. I assume iD is sending (meta) data about the person who is simply browsing the map to Facebook (i.e. without disclosing that info is being sent or what data is sent)?

Given the scale of the drama, you'd assume that it was something nefarious, but it isn't. iD loads images for brands from Facebook, and nothing more: here's the relevant code https://github.com/osmlab/name-suggestion-index/blob/66412f0...

Fun story from back in the day: we added 'social share' buttons to iD. Knowing the fundamentals of web security, they were implemented as simple links, with no JavaScript component on the iD side, no 'trackers', nothing of the sort. But some buzz came out about how other Facebook trackers were up to no good, and the OSM community got in a tizzy about how we had installed nefarious tracking devices in the codebase, and after a few days someone recommended that we should implement the buttons as simple links, which is precisely what they were in the first place. That combination of bad faith and nobody reading the code was constant.