This is one of the most compelling arguments against the laissez-faire attitude to sharing personal data that has permeated the tech industry as we've become an increasingly connected society. It's all very well saying the person who owns the device consented to RandomNotMalwareAtAllApp accessing their address book, or listening in on their mic, or accessing their camera or photos, but what about everyone else who is now being observed or data mined as a result of that action?

Obviously there has to be some reasonable middle ground, because otherwise no-one can ever provide an online service that offers a genuinely useful facility, say hosting email, even if it's done in a way that is respectful of privacy. But hoovering up someone's entire address book or photo collection or whatever, and then dumping the details into some database of shadow profiles or using it for other purposes that affect the data subjects? At some point, I think you are clearly across the line of what should be considered acceptable behaviour.