>The user logs into Facebook on the device. This log-in action the part of the user is effectively permission to share data with the device. As well as the dat

>The user logs into Facebook on the device. This log-in action the part of the user is effectively permission to share data with the device. As well as the data of 10,000 to 100,000 connected users as both friends and friends of friends have data pulled without any checks by the third party. "When the user logs into Facebook on the device, they are giving permission for their data to be transferred via an API to that device." When the user selects to have their data limited to friends only, and not friends of friends, then additionally disables API access to their data explicitly, no, they are not "giving permission for their data to be transferred via API". They are quite explicitly doing the opposite. My outrage, stated multiple times and oddly invisible to the users here, is that my user/password doesn't authorize the third party to access 10,000 to 100,000 other users private data, and those users personal settings should override any third party data hose utility.