When a User uses a Facebook app and the app developer gets not only a bunch of data about the User but also about everyone in the User's social graph, that should be illegal; the User's friends did not give consent.
Devils advocate, even us tech people don’t 100% understand the scope and reach of Facebook, what they are doing is unprecedented. It’s not like there could be really informed typical users.