A lot of comments I've seen draw the line between NYU's extension and Cambridge Analytica because the latter was using a native platform. But that feels like a distinction without a difference, if the net effect is still that "something I shared with my friend ended up in a third party's possession". Ultimately, if something has been shared with me, should I be able to save it or reshare it with others? The mechanism by which that save or reshare happens feels like an implementation detail.

Fundamentally speaking, who has what rights to shared data (like contact info or posts) feels like an unresolved question that has important implications.