That's not what happened here. People weren't actively posting their friends' details to some stranger. They were using an FB feature and checking a box. They barely even had any way of knowing exactly what data about their friends would end up being shared with the 3rd party.