In the Cambridge Analytica Case users where asked "do you want to share your data with that Game/quiz?" And users agreed. For average users understanding that control is hard, especially if people with bad objects are on the other side.

Not just your (user X) data, but your friend's (user Y) data. What if the API had sent user Y a confirmation, like "User X just installed CAapp and wants to access your information. Allow or Deny?"

If you take the "social" part serious frind's data is essential. When playing a game it should compare to your friends on the high score list. When using a birthday calendar you want to see birthdays.

Having to ask the friends for approval doesn't scale.

There is the fundamental conflict between a social network platform and privacy.

Facebook should have to access my API to display anything about me as a member. An API where I decide to whom and how much what data is shared.