Could they've achieved this another way? Still getting all the metadata for market research without a root certificate? If not, the step wasn't that appalling.

Could they've achieved this another way? Still getting all the metadata for market research without a root certificate? If not, the step wasn't that appalling. Compensating people for information on their behaviour is nothing new. If you participate in a program to report daily purchases you probably give away as many information and yet it's not viewed as controversial. The fact that Facebook doesn't have a great track record is problematic but generally, I don't see a big issue.