As someone who considered himself reasonably well-informed about the privacy implications of Facebook, the "friend permission" was still news to me. That Facebook would share my profile data with a third party because some Facebook contact of mine "allowed" it, is utterly horrific. It is also a clear and massive breach of EU data privacy laws. (Which unfortunately seem difficult to enforce against international companies at the moment; the GPDR can't come soon enough!)
In any case, if this should have been known by everyone already, I guess Facebook has no reason to panic if it's all over the news now. Just a bit of publicity for them, right?
I 100% agree, it's the friend permission thing that is criminal. Facebook no doubt covered their asses legally via the TOC, but I hope that the misleading nature of the (complex and ever-changing) privacy settings is mentioned in a lawsuit one day.
In any case, if this should have been known by everyone already, I guess Facebook has no reason to panic if it's all over the news now. Just a bit of publicity for them, right?