this data was voluntarily given to them by users It was given to them by the 1 million users that authorized the app. Not the other 189 million (or more) user

this data was voluntarily given to them by users It was given to them by the 1 million users that authorized the app. Not the other 189 million (or more) users. Also, that 190 million figure is probably inaccurate, because there is probably significant overlap in people's friends lists. According to their own campaign manager, they "sucked out the whole of the social graph" with Facebook's blessings. So they may have actually had more than 190 million, since there are more US users that on Facebook.