If you're a non-resident alien, they have to get the FISC court to review and approve a FAA 702 order targeting you. The bad news is that there's no standard of probable cause or anything remotely like it: more or less the only thing the FISC is actually even supposed to review and rule on is the likelihood that you are not a US citizen or in the US. The good news is that they still have to issue that FAA 702 order, and fewer than 2000 FAA 70* orders have been issued in any year prior to this one. (That number includes 702s along with other orders which can intentionally target US citizens or residents but involve a higher burden of proof.)

That still leaves the possible loophole of having those 2000 orders cover a huge number of people in a manner similar to the Verizon metadata order (which is a FISA order, but isn't a FAA 70* order and isn't counted among the 2000 https://news.ycombinator.com/item?id=5879366 ). But this Facebook disclosure along with earlier statements from Google and others allows us to cautiously rule that out (though we probably don't have the same clarity on the situation of all 9 PRISM firms).

Of course, none of this tells us much about what they're doing (or able to do) using "upstream collection" at the telcos. Or indeed through similar "direct collection" from non-US Web companies running non-US servers, which I'm guessing (IANAL) would probably be outside US law altogether.

They would still need to issue a National Security Request to compel Facebook to release data.