As someone who considered himself reasonably well-informed about the privacy implications of Facebook, the "friend permission" was still news to me. That Facebook would share my profile data with a third party because some Facebook contact of mine "allowed" it, is utterly horrific. It is also a clear and massive breach of EU data privacy laws. (Which unfortunately seem difficult to enforce against international companies at the moment; the GPDR can't come soon enough!)

In any case, if this should have been known by everyone already, I guess Facebook has no reason to panic if it's all over the news now. Just a bit of publicity for them, right?