> My friend allowed the app to ask Facebook information about me.

Unless there's a major security vulnerability, you can only delegate access to data you have access yourself. So your friend did the equivalent of giving Cambridge Analytica your data - the technical implementation of it (as to whether CA got the data off your friend's phone or from Facebook directly) doesn't really change the outcome.

How is this any different than FB asking for access to your private contacts, to "help" you find them on FB? What if one of your friends isn't on FB, and doesn't want FB to have their info? Your friend didn't give you permission to give FB their private contact information, ie phone number. FB then goes and makes a shadow profile based on that info you supplied without permission, and any time you mention or tag said friend, whether in a text of photo.

As I understand, it was a browser extension which scraped data off the Facebook pages visited by users. There is no way Facebook could reasonably detect or combat that.

I think you're confusing it with another recent FB event where they sued browser extension makers for scraping FB data.

https://www.zdnet.com/article/facebook-sues-two-chrome-exten...

> As I understand, it was a browser extension which scraped data off the Facebook pages visited by users.

That is false:

https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana...

Nevermind. I thought it was a browser extension. I was not aware of the "Open Graph" platform. Thank you for the correction.