This is an especially egregious case because it was well-known a long time ago that Kogan extracted a lot of really sensitive user data via the Facebook APIs th

This is an especially egregious case because it was well-known a long time ago that Kogan extracted a lot of really sensitive user data via the Facebook APIs that could be used for precision ad targeting. It says a lot about FB that they took this long to take any significant action other than getting a pinky promise from multiple companies that they deleted the data. Even if they deleted the data, they could have retained information generated using that data which would allow them to effectively abuse the original data for ad targeting - which they did years ago. FB had opportunity to know this long before now. It's bewildering that they knew this huge amount of sensitive data got into the hands of unauthorized third parties and were willing to treat assurances as a sufficient remedy. At the very least, all of their ad targeting should have been carefully vetted, but it seems ridiculous to let these third parties continue operating on the service when they had already demonstrated a willingness to blatantly violate the FB ToS and use unethical tactics for ad targeting. In practice FB users aren't informed enough to know what this means or care about it, but missteps like this really demolish any argument that FB cares about user privacy or ToS enforcement. They had a huge amount of time to realize this was happening and take action on it. At this point it seems unlikely that CA and SCL are the only companies doing things like this - it's not exactly a secret that these techniques are effective. If they wanted to make it clear to third parties that this wouldn't be tolerated, they should have cracked down years ago.