- Facebook allowed people to share their data and the data of their friends with third parties. So there was no requirement for me to use My Digital Life, or to accept a single permission prompt, in order for the researcher to have access to my data.
- people didn't "want to share their data", they wanted their quiz results. Was every bit of the data they provided required in order to get the quiz results? Doubtful. Were users aware that this data could be permanently stored outside of Facebook and used at a later point? Again, doubtful.
> that normally means they set an S3 bucket to public or got hacked
I'd argue that the combination of the above means that what Facebook did absolutely was equivalent to leaving an S3 bucket on public. Without absolutely any involvement by me, the researcher was able to access my personal data, and was given permission by someone whose understanding of what they were doing was, at best, dubious. Facebook knew all of this because they created the system it lived in, but didn't appear to consider the consequences, so yeah, I consider them responsible.
Not to mention the scale of data is radically different. I'm not over the moon about someone uploading my phone number to an unknown service, but it's mild compared to someone uploading my phone number, friend network, wall posts, photos shared, likes, etc. etc. etc.
As for the quality of the data. Right now any of your friends could have apps installed that are secretly leaking your private conversations with a third party and there is no realistic way for Apple or Google to know. That information seems more sensitive than what you linked. Why are you setting the bar higher for Facebook?
The difference is this:
> there is no realistic way for Apple or Google to know.
There was a way for Facebook to know. The tool was using their own API, so they knew exactly what was being fetched and how often.
I'm also not sure why it matters. Let's say Apple and Google are just as bad, I don't particularly care. It doesn't make what Facebook did any less worthy of scrutiny.
When the news reports that some company has exposed data, that normally means they set an S3 bucket to public or got hacked. I don't think many people would naturally describe the above scenario, where I voluntarily handed my Facebook data to a third party who lied about who they were, as "Facebook exposed your user data".