[bryan_w]

The user signed up, but the app would have access to that user's friend's data who didn't sign up

[beagle3]

It only has access to what the user is browsing; if a friend hasn’t posted in a year (and doesn’t appear on timeline) and user doesn’t go specifically to their page, then adobserver would be oblivious the the existence of that user (and of the friend relation).

This is entirely unlike an FB app like CA’s that had full unadulterated access to anything the user might browse.

[thesausageking]

Nope. This isn't a Facebook app. It's a browser plugin.