[PeterisP]

Someone who has view access to my profile may view my data, and they might also extract that information with API - however, they do not have any right to give permission on my behalf to someone else (e.g. Cambridge Analytica), that would require a power of attorney or something like that.

My friend might technically send that information to Cambridge Analytica, but my friend can't give them permission to use it, CA would be required to acknowledge that they don't have the legal permission to use that data and discard it. My friend can tell Facebook "I permit you to give that information to Cambridge Analytica" but Facebook is not allowed to act based on that "permission" since it's not something my friend can permit.

[Nextgrid]

> My friend might technically send that information to Cambridge Analytica, but my friend can't give them permission to use it, CA would be required to acknowledge that they don't have the legal permission to use that data and discard it.

It's pretty well accepted that Cambridge Analytica acted unethically, and potentially even unlawfully.

> My friend can tell Facebook "I permit you to give that information to Cambridge Analytica" but Facebook is not allowed to act based on that "permission" since it's not something my friend can permit.

This seems like an unnecessary technicality - if CA wasn't allowed to access your data directly they would just proxy it through the original user's device via an app or something. The end result would be the same.