Well under the GDPR data can only be collected for the purpose a person agrees it is collected for. So for example I may ask for your contact info at a club, so I can get in touch if something is cancelled or other club related reason.
If facebook federated with qoto, then I have NOT consented to my data being collected by them. I am not sure how federation / AP works in this respect but I understand some data needs to go between instances so we can share posts.
The data asked for by instances seems to be minimal, so I am not sure what metrics can be collected, other than the fact people here are very concerned about the GOP.
If people try to advertise here, we can simply block / mute them.
I would be more concerned about any threats to the LGBTQA AND other commuities (esp minorities) who feel safe here, hence they are on Fedi, and consequences from cesspits such as meta who care more for profits than human lives or human rights (or seem to).
Meta have just been issued with a huge fine for mis-handling data.