>An informed consent from users who's information is going to be collected.

That consent was granted the day they accepted/sent the friend request. Once the friendship was established, the other user had access to the profile information. They can do with that information as they please, which includes giving it to a 3rd party. If it's illegal to do so, the parties at fault are the user who accepted the API access request and perhaps the 3rd party, but definitely not the medium.

>Meta had an obligation to protect their user's data. It failed at that.

If I go to your profile and take a screenshot, has Meta failed at protecting your data? What if a friend gives me their password or remote desktop access to their computer and I look at your profile? Should we fine Facebook?