process to enable this feature ensuring the first-party data shared on CPAS would be used

only to run product ads of loreal

Retailers can create different audiences in Audience Manager and grant their brand
partners access to these audiences on Collaboration Center. Here are the steps for
retailers:
1. Go to Audience Manager and create audiences
2. Go to Collaboration Center -> Partner View -> Premium Options for a specific brand
partner
3. Select which catalog segment(s) of the brand partner to grant access to which
specific audience(s)
a. Selected audiences are enabled in the brand’s Collaborative Ads ad account
associated with the catalog segment(s)
Note: audience is granted access at a catalog segment level (shared by retailer), ensuring
that ads using only that catalog segment have access to the audience

How can retailers enable this feature?

See above for steps

complete control over first party data (addition, deletion, removal from account)
the retailer can revoke the access to these audiences at any time. You can see how in the
screenshot below. When a retailer revokes access to an audience, any ongoing brand
campaign(s), which use that particular audience, automatically pauses.
3- no other ads should be possible to be run except collab-ads (other entity should not be
able to use this for anything else ex:driving traffic to their own website)
The Domain Protection feature in Collaborative Ads ensures that a brand’s campaign
cannot direct users to another domain other than the retailer’s domain. Domain protection is
in place for Catalog Sales and Conversion objectives in Collaborative Ads ad accounts.
When retailers provide their brand partners access to specific audiences via Retailer
Custom Audience in Collaboration Center, domain protection will be applied to the Catalog
Sales objective campaigns targeting these specific audiences.

4- this product by FB should protect the first party data completely (no dups, data
extraction and other segmentation possible)
No, brands cannot access any information about these audiences. They cannot share,
download or see audience insights for these audiences either. They can only target these
audiences, see estimated audience size as part of ad creation flow, and see campaign
sales performance metrics for their products as they would with other Collaborative Ads
campaigns.