Cambridge Analytica is ironically totally not a refutation - it was never bought or stolen but abused their shoddy permissions. Against security illiterate users they could get the same thing with just 'login through this for a chance to win a free iPad'.