Only a few thousand people clicked through consent pages to share data specifically with the Cambridge professor who shared data with Cambridge Analytica. Facebook's APIs allowed that professor to then get data about those users' friends, who never made an agreement with that professor. Facebook has since shut down that API. https://techcrunch.com/2015/04/28/facebook-api-shut-down/