You will have to use Instant Games v8.0+ in this new model.
We are publishing a new model of permissions for Instant Games on Facebook. In this model, games will no longer have access to sensitive user information, primarily names and profile pictures of the current user or their friends. Instead, Meta will control the rendering of this information in separate iframe containers (called overlay views) that games will control separately, without having access to the data within.
This will remove the Terms Of Service blocking screen for new players when they play these games, thus enabling instant play.
Instant games will no longer have direct access to sensitive user data . Instead, Meta will handle the rendering of UI involving user data on behalf of Games through XML configuration files.
The rendering logic for this user information will be executed on a different iFrame.

Games can specify the files for the rendering layout of the Overlay Views in the game bundles. The current list of file formats supported in Overlay Views are:
Javascript is not allowed!
Meta will translate these XML files into the corresponding HTML with CSS to render the declared components.

Data in overlay views comes from two main sources:
Data can be supplied in a JSON object to the creation/update APIs (described in the Instant Games SDK section). For example, you can provide the following to the APIs
{
score: 10
}This can then be referenced with the curly braces syntax in your overlay view XML files with {{score}}
You can query user data using curly braces and special keys. For example, to request the user’s profile picture, you would mention the key {{FBInstant.player.photo}}. The complete list of current resolvable keys is as follows
{{FBInstant.player.friends[PLAYER_ID]}} key which only works for friends)There are two types of player identification supported in this model