Neither are reasonable risks. Mastodon admins have better things to do with their time, as do FB employees. 

Even the US gov’t showed how ineffective their surveillance during the riots / protests / insurrection / whatever in Washington. Weeks before that happened, I saw people openly planning various contingencies related to hiding weapons / evidence, vocal shibboleths (spoken passwords for a crude IFF, eg identification of friend or foe) on clearnet sites. Both on Facebook and on Q-drop repeaters (or whatever those are called), people were getting pretty serious.

Unless you are planning on blowing up the WTC again (3rd times a charm? people forget about ’93), or something like that- I wouldn’t worry much. Run TOR over VPN if you are feeling paranoid, I guess. 

The reason to divest from Facebook and Google has less to do with privacy and more to do with supporting monolithic corporate asshats whose censorship standards are enforced in a hamf-fisted fashion. I put up some pictures of the Pinkville Massacre in Vietnam, Operation “Just Cause” (alt, “just cuz..”) in Panama – both were almost instantly taken down on Facebook. I don’t know if they were reported, or if some “AI” ran their checksums across a list of ‘unpatriotic’ images- but I was deeply unimpressed.

Mastodon (or rather the fediverse) is trackerless, decentralized, and if you want -you can run your own server, with your own rules.