How does large scale companies implement privacy and user access controls

How do companies like Facebook and Google implement privacy controls at scale. For example, Facebook has a select audience type which includes public,friends, "friends except...", only me, specific friends, and even custom. From an implementation and design standpoint, how do these companies handle this? Are they defining rule bases access controls, are they manually coding in these features, do they have a privacy model they use, or is it an hybrid approach. If anyone have links to public avaiable design docs, conference links, white papers, and even reseach papers, please feel free to share. Everytime I try to search for how company "X" does privacy controls, I get the "Business" talk on privacy or access controls as what it relates to data center which is not what I'm looking for.