I think this is a concept that I find myself perplexed about. The defense of a lot of the use of acquired data is, "but you opted in!", which is of course true. However, when we give software access to things it's usually expected that the access is to conduct tasks pertaining to why we would want that software in the first place. For example when I use a web browser I give it internet access so that I can browse the web, or whatever. Not so that it can phone home and tell a company what websites I've been browsing. I feel like the defense, "yeah, but you opted in to allowing it access to the internet!" is a bit misleading.

Perhaps the personality quiz example that seems to be the cornerstone of this whole CA story is different: I'm not sure what your expectations would be allowing such an app access to your messages would be. However, there are quite a few examples of strange behaviour of software running on phones that it's pretty clear that isn't what you had in mind when you opted in. An example that comes to mind is Facebook apps activating your microphone to log conversations with people you have in person (I'm not sure there is any proof of this one yet but would anyone be surprised?): when you opt in to microphone use it's so that you can make calls on the app not to invite spying. "But you opted in!" Yeah, okay. "Sorry!" - Zuckerburg