"Also, we require our advertisers to provide sufficient notice to and gain all necessary consent from their users for their use of the Facebook products and the collection of data in our Terms, which includes a link to Facebook's Cookies Consent Guide for sites and apps.
Like today's policy, the GDPR requires that data is only held for so long as is necessary for the purposes for which it was collected, and that data subjects are informed of the retention period or the criteria by which the retention period will be determined. Facebook will continue to comply with these requirements. You can read more in our updated Data Policy, which covers both Facebook and Instagram.
Aside from reviewing our updated terms, there is no additional action an advertiser needs to take today to prepare for our updated terms effective data (May 25). They can review our updated terms here: Facebook Business Tools, Custom Audiences, Data Processing Terms. When advertisers create a campaign on or after May 25, 2018, they will be asked to review and accept the updated product terms in order to run ads, just as they do today.
Advertiser can continue using existing Custom Audiences and analytics data, but it up to the advertiser to determine whether that have a legal basis for continuing to use this data post GDPR.
Currently, Custom Audiences already requires advertisers to have all necessary consents required to use their CRM data – the only thing that is changing post-GDPR is that we are changing the terms to expressly refer to a ‘legal basis’ rather than consent. So, advertisers must determine what rights they may have to use their existing customer data for use on Facebook. To the extent that have a legal basis for this use, their use of the Facebook products should be unaffected.”