I don't think social media companies have any CSR to protect the privacy of its users. After all, we post our pictures on the platform for the whole world to see. More importantly, we don't pay them to show our pictures to the world, so there is nothing wrong with using our data to generate money.
I tend to respectfully disagree with Vincent Tawiah
Of course, one could argue that personal data is the price we have to pay for free social media use and part of the business model, but things change if personal data can be used against the user without him or her knowing it, infringes his or her autonomy in decision making etc. Maybe a tip is to read the recent book by Zuboff on surveillance capitalism, in which she makes clear how privacy transformed from personal to public information, and why this changes the whole discussion about responsibility for privacy. There you can find amunition why big tech companies should take a responsibility for the negative impacts of their business practices.
Corporate social responsibility is the practice of integrating social and environmental goals into business activities.
Social media companies have done to protect the privacy or information. They use encryption method of their information. This is very helpful , I think.