Facebook has agreed to pay a $20 million penalty for misleading consumers by representing that its discontinued Onavo Protect mobile app would keep users’ personal activity data private, when in fact it was being collected for commercial use.