Flutterby™! : Cambridge Analytica and Facebook

Motherboard: Why We're Not Calling the Cambridge Analytica Story a 'Data Breach'

In 2014, a researcher collected the data through an app that asked users to take a personality test for academic research purposes. Around 270,000 people agreed to have their data collected through the test, which its creator, Aleksandr Kogan, defined as “a very standard vanilla Facebook app.” But thanks to Facebook’s terms of service and its API at the time, the app was also able to collect data of their friends. This gave the researcher, who later handed the data to Cambridge Analytica, the raw information of more than 50 million people, according to the reports, which were largely based on the account of a former Cambridge Analytica data scientist.

Basically, Facebook was operating as designed. The problem from Facebook's point of view is that a hostile foreign government used the data rather than, say, your average marketing department. Facebook's complaint here is essentially that they were disintermediated in the ad marketing process.

The New York Times: How Trump Consultants Exploited the Facebook Data of Millions, the Guardian: Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach