Meta has previously said that it is technically unable to distinguish between data from users in the EU/EEA and other countries where people don’t enjoy GDPR protection. Meta has also said that it cannot distinguish between sensitive data under Article 9 GDPR, such as ethnicity, political opinions, religious beliefs (for which the “legitimate interest” argument is not available under the law), and other data for which a “legitimate interest” could theoretically be claimed.
If cannot distinguish, default should to treat all data sensitive. That not in gdpr? If not that huge oversight.