I think the dichotomy you’re pointing will affect Facebook’s legal tactics, but has no bearing on the privacy risk they need to defend against. In both cases, F

I think the dichotomy you’re pointing will affect Facebook’s legal tactics, but has no bearing on the privacy risk they need to defend against. In both cases, Facebook has an API that served data for some authorized client for a specific purpose (users browsing Facebook, users taking a quiz), but really there’s some entity pulling the strings and misusing the client to amass user data (collecting data associated with users who took the quiz, collecting data associated with users browsing on Facebook).