Phone #2: PhoneNumberX was never used on this phone apart from WhatsApp that had PhoneNumberX linked to it. Installed Facebook app. Logged in to my Facebook account. Facebook app did not have access to photos/location/etc due to privacy concerns. After some time i deleted my Facebook account and uninstalled the app. Cleared Safari cookies/etc. Ad tracking on iOS was disabled in settings by default. Six months later my friend installed Instagram app on this phone and registered his Instagram account (phone number was not used) and signed out. Instagram app uninstalled.

Phone #3: My friend is using his Instagram account on his own phone and gets a notification: "Do you want to add YOUR PhoneNumberX to your Instagram account?" This prompt have appeared once just recently and there is no way to find PhoneNumberX anywhere on his account to alter or change this.

To me it seems that Facebook is using some form of secret fingerprinting that got Uber in trouble with Apple. See here: https://www.the-parallax.com/2017/04/26/uber-device-fingerprinting/

Now that Facebook without my knowledge have linked data from my deleted Facebook account (or WhatsApp account?) to my friend's Instagram account in some form of shadow profiling it is unclear what can be done to remedy the situation. There is no tool available for public to access these shadow profiles even though they are clearly a part of users data. Privacy implications are huge.

What would security/privacy experts recommend in this situation?