[Nextgrid]

Not disagreeing with your other points but Facebook didn't sell anything to Cambridge Analytica and in fact wasn't even really complicit. All they did was provide them with a way to request access to people's accounts as a standard OAuth2 flow. Idiots agreed to the access requests and as a result gave not only their own information but the information entrusted to them by friends.

The proper response to CA would've been to send everyone affected a notification saying "Your friend <name> shared your data with a third-party that is now known to be malicious. <Unfriend> <Learn More>".

The real issue with CA is that people are dumb enough to trust anything they see on the internet without a second thought. Why does a stupid "personality test" require access to my Facebook account? It doesn't and they should've declined the access prompt right there and flagged the post as malicious.

[bornfreddy]

To be fair, granting access to one's Facebook account is a pretty good indicator of one's personality. :)