I think the problem is just how much data was available in those friends’ profiles, which were downloaded through an app, enriched against other data sources (voters’ roll etc.) and used for nefarious means that violate the Terms or Service but not necessarily the law.