Is GDPR the end of Facebook’s reign over personal data?