There is a python script floating around that will sync your communities, etc. I’d link but don’t have it handy.

In the US I highly doubt any of that would be illegal save in maybe California. But if I for instance had my email associated with my fediverse account and my friend had my contact name plus my email then meta could ostensibly build a profile out on me without my knowledge or consent. That would only be limited by my friend who might have way, way more interaction with me on the rest of the phone (sms, etc etc) to build an even fuller profile. That’s basically what I’m suggesting. My fediverse account might not say much about me by itself but by linking that and other data courtesy of my friend, I’m now a decently built profile to meta.

Couldn’t meta theoretically scoop up all their user data including contacts and then actually link that to other users?

I’m not talking simple fediverse data- I’m talking all interaction elsewhere on the phone and other platforms then associate that to fediverse data too.