How does large scale companies implement privacy and user access controls

Question

How do companies like Facebook and Google implement privacy controls at scale? For example, Facebook has a select audience type which includes public,friends, "friends exce