Well there's three parts to this: One is that data was collected without consent - ie, the third party can collect information about me because my friend gave c

Well there's three parts to this: One is that data was collected without consent - ie, the third party can collect information about me because my friend gave consent. That's something that facebook has actually stopped now - but the damage is already done. The second is that Facebook weren't diligent with who allowed to access this data - the 'researcher' collected data and then passed it to a commercial entity with no consequences. This is probably in breach of quite a few laws (especially in the EU). The third is that Facebook knew that CA had participated in this deliberate breach of their terms to steal data and allowed CA to continue to use this data to target advertising on FB during an election campaign. They only banned CA after it got bad publicity, rather than when the actual infraction occured.