FaceMash is a very primitive example of mass surveillance and data gathering: use people's pictures without their consent, collect the social rankings in a database somewhere.

He was definitely planning on PII abuse at scale for personal gain from day one. Probably not planning mass surveillance, but from all we know of him, he wouldn't have disliked the idea.

Wrong. He literally made fun of users for giving information that he could use to spy on them and share that ability with friends. It was a childish form of spying but the intent was there and the monetization tactic came later.