Why is it that all of the times Facebook claims a "hack" it's really Facebook giving away or selling user data via an API, getting caught and than claiming it as a "hack" to avoid responsibility?
The app piggybacking and the initial "View As" stories constituted Facebook handing out data sloppily. But location records, search history, and TFA-only phone numbers are internally held data Facebook wasn't showing to anyone. This moves things from "faulty visibility settings" and "shady data sales", which we've seen before, to "outright security breach".
I see this repeated about other tech companies as well but I can never find where they say they sell my data. It seems weird companies would sell their most valuable asset, rendering themselves moot.
My understanding is these companies allow advertisers to target users, but never sell the data.