GDPR would not have permitted the disclosure of users' "facebook friends" data to a third-party automatically without explicitly asking those users first. That

GDPR would not have permitted the disclosure of users' "facebook friends" data to a third-party automatically without explicitly asking those users first. That is an example of a relevant regulation which would've prevented this. I don't really care if you want to give a lot of your personal data in exchange for filling out a quiz that is unrelated to what your personal data will be used for, but the network effect (combined with how many things your "facebook friends" can see) of Facebook means that other people in your social graph should care. (FWIW, I agree that "breach" is the wrong word. It's far too soft on Facebook. "Exploitation of the soon-to-be-criminal disrespect for users' privacy" is much more accurate IMO.)