I guess my question is from a security standpoint, how do you prevent something like this if you were facebook? Do you ask any company who does a huge number of API requests requesting peoples friends lists? To verify how they are using the data? How do you actually confirm they are doing what they said?

According to the article only ~200k people installed the app and consented. Unless there was an exploit, you get a minimal version of the data in their friend list (user id, name, that is all i really see) not a full profile. So didn't they only really get the names of 49.8 million people?

Is the solution to just not allow allow a third party token to access a friend list, and only your personal information?

I am not trying to defend what is going on, i am just struggling to see how they were able to use the extremely minimal amount of information the friend list api returns to make a full profile on 50 million people.