There are I imagine laws about protecting your customers data and not allowing apps and plugins to for example steal every connection people have on the platform. CA were not "hacking" Facebook they were using the platform as is and if that allowed these types of abuses the court clearly determined they had broken the law.