[stvswn]

Do you know for a fact they only had access to those messages? If that's the case, Facebook should be very clear about this in their response, and I'm not sure why they wouldn't be. Copying from their response:

"Did partners get access to messages? Yes. But people had to explicitly sign in to Facebook first to use a partner’s messaging feature. Take Spotify for example. After signing in to your Facebook account in Spotify’s desktop app, you could then send and receive messages without ever leaving the app. Our API provided partners with access to the person’s messages in order to power this type of feature."

So, why wouldn't Facebook add here: "to be clear, the third party apps only had access to messages which were sent and received from the app. Private conversations with friends could not have been leaked to the third party companies" or something like that?