This is one of the most compelling arguments against the laissez-faire attitude to sharing personal data that has permeated the tech industry as we've become an increasingly connected society. It's all very well saying the person who owns the device consented to RandomNotMalwareAtAllApp accessing their address book, or listening in on their mic, or accessing their camera or photos, but what about everyone else who is now being observed or data mined as a result of that action?

Obviously there has to be some reasonable middle ground, because otherwise no-one can ever provide an online service that offers a genuinely useful facility, say hosting email, even if it's done in a way that is respectful of privacy. But hoovering up someone's entire address book or photo collection or whatever, and then dumping the details into some database of shadow profiles or using it for other purposes that affect the data subjects? At some point, I think you are clearly across the line of what should be considered acceptable behaviour.

What reasonable middle ground does there need to be? If I share my contact book with an app I want:

1. That data to go exactly nowhere. 2. The company to not profit from the data except by profiting off me directly using their service. 3. That company to not allow anyone else (including me!) to do shady things with that data.

It’s not really complicated. It does make some business plans impossible, which causes some people to make absurd rationalizations.

That is exactly the sort of middle ground I had in mind. You aren't entirely prohibiting sharing data that might involve other people, but it is only shared for a specific purpose requested by the person providing the data and never used for anything else.