That's debatable. CA either bent the rules or broke the rules to get a lot of that info. In many cases, CA was able to get not just the target's info, but all of their friends info too. Facebook was either incompetent or complicit in allowing this to happen.
> Even if no one was being tracked, the exploitation could have occurred.
What do you mean? How could CA work without any data?
Tracking, in this context, means tracking behavior across other websites. CA got data that was created simply by having a Facebook account and friending other people (they used oauth/login with Facebook). Facebook would have to not have existed, or not provide as much data to third party applications, to prevent their collection.