The Cambridge Analytica scandal was super interesting to me because it reflected an entirely standard and unremarkable data-collection process that I'd seen several times. And yet it filled international headlines. Congress was interested.
It's easy to do. You create some app that has "login with Facebook". That's great for users, right? One less password for them to remember. Then as soon as they log in you make a quick call to the Facebook API, get all their friends, and dump it in some database table.
Even if only a few people log in to your app, you can get a database of thousands of real people.
I don't work for that type of company anymore, but I've been many places where that was bog standard, the very first code you write for a new product.
Does anyone know if the Facebook API has changed now?