Exactly. Big difference between:

1) asking a user who had signed up for the Obama campaign if the campaign could contact their friends Johnny and Sue (discovered via their Facebook API) to ask them to support the Obama campaign.

2) Obtaining Facebook data by a professor for an academic study, who then turns around and sells said data to Cambridge Analytica, who uses it for targeted fake news propaganda. All of this without any consent from any user.

Add to this the fact that CA was also self-admittedly conducting political blackmail and bribery, and allegedly hacking election results, and you have a pretty ugly picture.

While I agree that the professor acted unethically, above and beyond the original problem with the Facebook API. This depiction of the Obama campaign is too rosy:

> 1) asking a user who had signed up for the Obama campaign if the campaign could contact their friends Johnny and Sue (discovered via their Facebook API) [...]

The idea that Alice has any right to consent to the dissemination of other people's (Bob and Charlie) data is just ridiculous. Just because they're called "Facebook friends" doesn't mean they have any more rights to give out my information than any other stranger. The entire concept is busted. To my mind that is still unethical, even though Facebook permitted it, and the Obama campaign was clearly the user of the data (rather than a fourth-party).

>The idea that Alice has any right to consent to the dissemination of other people's (Bob and Charlie) data is just ridiculous.

I agree. However, I think it's ridiculous to claim that what the Obama campaign did and what Cambridge Analytica did is ridiculous. And by the way, you mention it was unethically of the Prof to sell the data, but what about CA buying it? Do they get a pass?

> And by the way, you mention it was unethically of the Prof to sell the data, but what about CA buying it? Do they get a pass?

I think CA's (or any company's) micro-targeting of advertising using detailed profiles of the person is unethical in general, but whether or not CA is in the wrong for buying the data depends on whether they knew it was given them without the consent of users (I haven't followed whether we know that). But CA has a lot of other unethical things they do, so they don't get a pass in general.

But I feel that the bulk of the blame for this should be on Facebook's shoulders as well as the Prof who sold the data -- they both provided outside parties data for people that had no reasonable ability to consent to that dissemination.

Not exactly, they obtained data of friends of people who consented. That doesn't mean the friends consented. That is almost the same as Cambridge Analytica did with their quiz. I don't see much of a difference.