Unfortunately it is fully legal in the US. The US has extremely weak internet consumer consumer privacy laws including things normally subject to HIPPA laws. The only places that shifted the mass data collection back in the consumer's court is Europe or ironically, California, but you have to be a citizen of either.

I bet FB then sells the vaccination data to businesses, and then resells that data to camera companies like Ring/Amazon or Apple/Google so they can automatically identify people walking into businesses w/o vaccines. All of this technology already is trivial and is widely deployed in China.

It's also why FB is carpet bombing various news media with "please regulate us". They do know that regulation is inevitable, but just want to be the ones writing it.