Yup. Anyone expecting privacy on a federated service has been inherently misinformed about how federation works. Everything I do here is assumed to be public.
And I also assume that state agencies are running their own instances, to suck up as much data as they can. They can just federate with the big instances, and then the data gets firehosed directly to them via the built-in federation. It’s why AI scrapers on the fediverse are so frustrating. The scraper could just spin up an instance and passively collect all of the same data via federation. But instead, they just DDOS the instance owners.
Also, the users who bitch and moan about downvotes (because they can see who downvoted them) are pure comedic gold. I have seen users try to call out the specific people who downvoted them. Like they’ll edit their comment with something like “hey @{user1}, @{user2}, @{user3}, care to explain why you downvoted?” The only thing that ever accomplishes is getting them buried in even more spite-downvotes.