That said, your basic point still stands because the issue is one of who gets to control the data about each person. In effect, Facebook has tried to trap the data for its own exclusive use through its terms of service, even while confirming that technical ownership lies with the user.
Some highlights from the EFF brief that bring out some of the tension on these issues:
1. FB is really trying to apply a heavy hand against third parties such as Power Ventures who have the temerity to supply tools that allow users to gain more control over their own data and how they use it. Section 502(c) of the California Penal Code criminalizes unauthorized access to network data (among other things) whenever someone "knowingly accesses and without permission" does certain things with such data (including if someone merely "accesses or causes to be accessed" such data). The major 502(c) precedent of a thirty party getting busted by Facebook itself is the case of ConnectU, which had been sued by FB for scraping email addresses of non-ConnectU customers from the FB site and then spamming them. In that case, the access violated Facebook's terms of service and ConnectU was found liable. However, ConnectU had accessed the information from FB users who had not given it permission to gain that access. ConnectU had argued that it did not violate 502(c) because the users had made their email addresses available to FB and that it thus did not engage in unauthorized access in violation of the statute. The court disagreed, finding that the FB users could disclose their email addresses for "selective purposes" only without giving third parties broad rights of access to them. Given this precedent, FB is claiming that Power Ventures is similarly liable for gaining access to FB user data in violation of FB terms of service. Thus, the key distinction by which EFF seeks to distinguish the precedent is by saying that, here, the users not only own the data but also give their permission to Power Ventures to access it. EFF further argues that any violation of FB terms by Power Ventures or by users might be grounds for civil liability but is irrelevant to the question of whether a criminal act has been committed by such access because the only time this would amount to a crime is when a user's rights are violated by someone who hacks into their data without their permission. Therefore, "[w]hen a person is authorized to access certain information . . ., mere use of an unapproved technology to access that information cannot constitute a criminal act under California Penal Code section 502(c)." (Brief at p. 10) The EFF brief (submitted as an "amicus" or friend-of-the-court brief) is compelling on this point and makes FB's position look pretty laughable - I think the court will side with Power Ventures on this one.
2. FB has already won a round in this fight with Power Ventures by getting a related ruling to the effect that the FB terms of service effectively deny users the right to authorize circumvention of FB's technological protection measures for purposes of copyright circumvention. In other words, even though users might authorize a third party to have access to their information, FB can block such access on at least one important ground via its TOS (thus trapping the data for its exclusive use).
3. In February 2009 Facebook tried to modify its terms of service to give FB the right to continue to use content indefinitely, even if a user tried to delete it or even quit the service. This created a firestorm and FB dropped this effort. This was not for legal reasons but for practical ones - it could not afford to alienate users in this way.
4. The civil claims that Facebook might assert against third parties for violations of its terms of service are considerable and this appears to be the main vehicle by which FB is trying to prevent others from gaining access even if the users themselves are giving the third party permission to have such access. The contract claims are pretty clear in such cases, and FB can even terminate the accounts of users who violate its TOS in this way - but, again, the tension point is that FB does not want to alienate its users even as it seeks to corral their data for its own commercial use exclusively. Yet the contract-type barriers are formidable in this respect and FB may well get away with it if its TOS are ultimately upheld and are not found to violate public policy so as to render them unenforceable.
My own observation: it seems that, more and more, companies are trying to set up their own playgrounds where they control everything and capture the value for themselves (the parallel with 3.3.1 in Apple's terms of service cannot but come to mind). In each case, third parties attempt to gain access to the walled-off platform in an attempt to make its value (information in the case of FB; apps in the case of Apple) accessible to other competing platforms and are met with stiff resistance in the form of overbearing terms of use that seek legally to prevent that value from being shared. Of course, in any such scenario, two things happen: (1) the users lose because of the arbitrary restraints; and (2) the law is pushed to the limit and questions begin to arise about how enforceable some of these restraints really are. All this will be tested over time but the battle is already pretty fierce.