this is the kind of over-reaching that GDPR was (in part) designed to prevent: MapMyRun doesn’t need all my contacts in order to share a workout to facebook, but it wants them, and it checks this box by default.