Also see The Facebook breach makes it clear: data must be regulated (The Guardian) and How Facebook’s Data Sharing Went From Feature to Bug (NYT)
"Facebook once appeared to acknowledge that some data collection by developers ran counter to the expectations of Facebook users. In a 2014 news release announcing new restrictions to its developer policies, a Facebook executive wrote, “We’ve heard from people that they are often surprised when a friend shares their information with an app.” That admission may indicate that people had not been given adequate understanding of how their data and their friends’ data were used by third parties.Facebook’s rules for accessing user data lured more than just Cambridge Analytica - The Washington Post
Facebook “goes into this endless hairsplitting that people should have known,” said Marc Rotenberg, president and executive director of the Electronic Privacy Information Center, a nonprofit advocacy group that has brought privacy cases before the FTC. “No one could have known that their friends were disclosing their personal data on their behalf. It’s entirely illogical, and it breaks the consent law.”"