I want to reach my friend Pete through "media". But I don't really care about his ad-relevant personality matrix, I just want the endpoint. The profile metadata is the aspect created and mistreated by FB, and abused by CA. I suppose scraping the proposed hypothetical API would be akin to getting a large list of valid emails, but it's not as useful for targetted agitprop.
You misunderstand what happened. 1) Users installed a quiz app, 2) Users explicitly accepted a permission dialog that included "information about your friends", 3) The quiz app saved this data, 4) Cambridge Analytica bought the app (and data).
If CA got your data, it's because one of your friends sanctioned the critical link in this chain.
Facebook at least provided this level of security, however illusory it may have been. In a decentralized system, anyone who touches a piece of data can pass it on to whoever they want. There is no way to enforce "my friends can look at my data but it's my data and they aren't allowed to pass it on".
Privacy advocates and decentralization advocates are mortal enemies; their only common cause is that it's popular to hate on Facebook these days.
And CA “leak” was way more tame than this, just the information displayed on your profile for all of your friends.
I can see arguments both ways. Some folks would be ok with it (they're your friends) and others wouldn't (you can't change the privacy setting on data that's already been downloaded).
Similarly with friends list. A person's list of friends is probably "their" data, even if it has your name on it. Would you be ok with them downloading this information?
The trade-off between control of some users and the privacy of other users is a complex issue. Let's not pretend there are simple answers to this.
The implicit assumption here is that the only people who can control your data are big, centralized organizations. Instead of big companies making little people subject to DRM, what if we turned it on its head and gave control to the people? What if we made big companies subject to Digital Human Rights Management? Basically, we legislate that social media, tech companies, and government organizations use Trusted Execution engines to handle private/personal data, and the user gets the keys and gets to revoke access from those organizations.
Let's say I put all of my friends' birthdays in my calendar. Now the data has left the silo and I can reshare it with whoever I want. Just how is anyone going to revoke that ability?
Also, it's not meant to be a complete solution by itself. It's meant to be a tool supported by other legislation. So it would totally be possible for Facecorp to crawl the web and put together a non-revokable database of private individual's information, outside of Trusted Execution engines. But to do so, they have to go to that effort, instead of just sweeping user data.
Having to ask the friends for approval doesn't scale.
There is the fundamental conflict between a social network platform and privacy.
That is literally what Facebook had, and what people excoriate them over thanks to Cambridge Analytica. The Facebook haters are driving social network data into a silo; how else are you going to "keep control of your data"?
You can have privacy (or at least the illusion of privacy), or you can have access. You cannot have both.