I'd imagine it's at least partly expectations - people know that Facebook has their data (even if not the full extent), so adding an additional class of data do

I'd imagine it's at least partly expectations - people know that Facebook has their data (even if not the full extent), so adding an additional class of data doesn't change that fundamental understanding or register as strongly. The fact that a third-party can pull your data out of Facebook is less obvious. The fact that it was used for political ends probably makes a difference as well, both in the amount of coverage it is receiving and that it makes the use of data into a more concrete issue (it's much easier to understand "this is what the data was used for" then "Facebook has your data and that's bad for hypothetical/abstract reasons"). > Isn't the Cambridge Analytics headline really just, "Group doesn't follow website's terms of service from five years ago" That's the act, but I'd say the usage/intent behind doing so is part of the story.