Android - New Facebook app activates GPS when launched -- how to disable?

Similar to Permissions Denied, mentioned by Matthew is LBE Privacy Guard which also allows you to selectively disable permissions for apps. Also good for disabling geo-tagging on your photos as well as preventing Facebook and/or Twitter from broadcasting your location.

Stock Android doesn't offer ability to disallow apps use of specific permissions. At install time, once you agree to accept whatever permissions the app requests - you are stuck with them unless you uninstall the app.

Since you are rooted, you can try using Tasker to automate enabling of GPS only when using certain apps like Maps, and disabling it when the app exits. This way you can keep GPS disabled, so that Facebook and any other apps don't automatically lock in on you.

Also, the CyanogenMod 7.1 custom ROM does have this feature. Here is a step-by-step installation guide on installing it on your Milestone. In CM7, on the Manage Applications settings, when you tap on any app you can tap on any permission to revoke it (it will get crossed out.) Tap it again to undo the change. Keep in mind that although apps usually handle absence of Internet or GPS permissions gracefully, some more basic permissions (e.g. writing/reading to/from SD Card) might cause the app to crash or become unstable.

An app like Permissions Denied (requires root) can help with that. It says it doesn't work on every device and ROM but there are other similar apps that might if this doesn't do the trick for you.

Generally you could also unpack the APK, edit the AndroidManifest.xml file to remove permissions, repack everything, and install that modified version. I'm not sure if it works for signed apps (are there encrypted apps?) though, I can't currently find the guide I had read to do this. It may also be against the terms of use and so on, so make sure you know and take responsibility for what you're doing :)