Earlier quoted context omitted.
They are absolutely required to report this to the data protection agencies in all European countries. As the other comment mentioned, missing the 72 hour deadline on this is enough to get a fine as Booking.com did. I'm curious to see the total in GDPR fines from this for Facebook. Will probably take a year or two before we know.
GDPR is a gift to large corporations. Regulatory capture in return for a slap on the wrist. It also burdens startup competition and trains people to click "Allow Cookies" and "Accept the Terms of Service" as fast as possible.
GDPR fines are scaled on revenue to prevent for precisely this reason