I think "giving information about friends" is kind of a stretch. Facebook has that information. Clicking something so Facebook does something with it isn't quite the same as, say, entering all that info into a text field. Maybe it is legally, but morally, from a commen sense perspective, FB gives the info out. Allowing API access is giving info. We all know how servers work. You can't "take" something, it always gets sent.