A fine is a cost. It's quite possible that Twitter made more than $150m in doing this.
It was almost certainly a fuckup where the phone # was mistakenly stored in a shared schema, and someone on the ads side saw it and decided to use it for targeting, knowing nothing about 2FA or how it got there. This probably only affects a tiny fraction of their users.
Potentially, sure.
>It was almost certainly a fuckup where the phone # was mistakenly stored in a shared schema, and someone on the ads side saw it and decided to use it
How is this an "almost certainly"? Do you have additional information you'd care to share on why you think so? If this were the case, it would point to insanely sloppy policies, procedures, and implementations.
>This probably only affects a tiny fraction of their users.
Why?
Because most users provided their phone number when signing up, not just when setting up 2FA. Twitter has always been phone-centric (the first app was literally just sending SMS messages).