I believe that's correct. People gave concent to X but Y used the data. Perhaps that's a violation of FB's ToS for apps?

That said, (personal) data gets brokered all the time. And, btw, sometimes the buyers are gov agencies. Who needs surveillance when people willing hand it all over, often in public.

Perhaps not the public will finally begin to understand why the phone meta data "intrusion" was so bad.