> CA's research was violating privacy laws because it was gathering personal data from Facebook's users without their consent.

It actually gathered data from fb users with explicit consent (a login with FB dialog along with a permissions dialog box). The app then scraped the public information of that user's friend's list.

If you replace "friends list" with "ads list", it seems to have pretty strong similarities to what's happening here.