Cambridge Analytica got their data through a paid quiz that didn't fully disclose to the user what their friends and own data were going to be used for.

It almost certainly broke EU data laws, and CA referred to their data operations as 'propaganda' when speaking to clients. https://www.engadget.com/2018/03/19/cambridge-analytica-chan...