Cambridge Analytica had no way to buy Facebook ads, which were the primary platform of these micro-targeted ads during the campaign, specific to people in the gathered data they had without Facebook platform support. Facebook ads never had an API that you could just give it user IDs or emails and target them specifically (and one would hope that Facebook would eye any such ad campaign with suspicion even before scandals like Cambridge Analytica). Cambridge Analytica had to encourage Facebook to add most of its same demographic markers into the platform to pull that off. That's definitely one of those "it takes two to Tango" sort of things where if it wasn't in Facebook's platform, how did they target those ads in 2016?

Certainly they cross-compiled that data with other ad systems and phone lists and who knows what else, but given the scandal with respect to that specific campaign was primarily about their micro-targeted Facebook ad buys, Facebook is still left culpable as the platform owner at the end of the day.

But I'm of the belief that micro-targeted ads should be illegal in general, and all of the micro-targeting enabling ad platforms seriously questioned for what they've enabled in the last decade or so. The fact that they are generally acceptable and multi-billion dollar revenue generators is its own reminder of what this thread is about that the average person doesn't seem to care about all of these invasive data privacy issues.