Yes. CA got all that data through the API. They paid users to take a mechanical turk survey that requested large fb perms. which the time included a lot of data

Yes. CA got all that data through the API. They paid users to take a mechanical turk survey that requested large fb perms. which the time included a lot of data on their friends, beyond their own single profile data. That has been shut down.