Perhaps the personality quiz example that seems to be the cornerstone of this whole CA story is different: I'm not sure what your expectations would be allowing such an app access to your messages would be. However, there are quite a few examples of strange behaviour of software running on phones that it's pretty clear that isn't what you had in mind when you opted in. An example that comes to mind is Facebook apps activating your microphone to log conversations with people you have in person (I'm not sure there is any proof of this one yet but would anyone be surprised?): when you opt in to microphone use it's so that you can make calls on the app not to invite spying. "But you opted in!" Yeah, okay. "Sorry!" - Zuckerburg
I feel like private messages are something that should never be granted to third party apps on Facebook. People just click allow because they assume whatever is listed, is being used for the purpose of the application.
You had to authorize the messages permission separately from all other permissions. If you didn't want your messages accessed, you simply declined that permission. This one's on the user, not on anybody else.
The Obama For America app stole data from about 4x the number of profiles that this app did - about 200 million people, less than 1 million of whom gave them any form of consent, much less informed consent, as was given here with the messages permission. Do you have an issue with that app’s title?
Everybody (and Facebook best of all) knows that users will click [Accept] or [I've read the 27 page T&Cs] or [I hereby give Cambridge Analytica my firstborn child] without even slowing down to consider any consequences - in return for another tiny dopamine fix.
I believe, a reasonable person, would expect the limits of the access grant to end with the purpose of the app (a quiz) and not extend any further.
Most contracts/agreements have limits and this one is implicit in the working of the app. It is in no way clear that the app is earning it's money by selling/manipulating the data you're giving access to.
Additionally, it's disingenuous to ignore that a subversive app will make up/add features in no way benefiting the end user but for the sole purpose of scraping messages.
Intent is important, for some of these apps it is clear the only intent was to harvest data en masse.
Yes the user agreed to grant some permissions so a quiz could be taken. It cannot and should not be ignored that the app developer purposefully did not disclose the true nature of the app. This wasn't an accident. They didn't trip and fall into the data. They made something appear benign when it was really cancerous.