My understanding is that CA got the data by building a free quiz app on Facebook’s platform (I don’t think FB was getting paid for that, correct me if I’m wrong

My understanding is that CA got the data by building a free quiz app on Facebook’s platform (I don’t think FB was getting paid for that, correct me if I’m wrong). The difference is that the quiz app used Facebook’s developer-facing APIs to access the data, whereas these Chrome extensions are hijacking the user agent to access the data via Facebook’s browser-facing APIs. I don’t think it makes a difference as to whether Facebook ought to try to stop the data collection to prevent the another CA-type scandal, and to protect itself from the resulting uproar. The fact that the extension developers haven’t made any agreement with FB means that FB needs different legal tools to try to shut it down, and perhaps they won’t succeed.