There is an exception for data that is required for the functioning of the service. You need your friends email address to use email, but do you really need their birthday or a sentiment analysis of their opinion of cheesecakes?
> but do you really need their birthday or a sentiment analysis of their opinion of cheesecakes
If you go back to the Wild West of the Facebook apps, shortly after platform launch there was an app for everything - apps for fancy birthday cards with birthday reminders, as well as polling apps telling you which one of your friends is the biggest cheesecake lover.
Every piece of data can be spun into being essential.
A polling app building a “psychological compatibility profile” can arbitrarily add new data points, and “streamline” the onboarding process by collecting all of the necessary data with one click (with fully disclosed list of collected data points).
Which is what CA has built.
Not just them - any survey app claiming to help you find out “which Game of Thrones characters you and your friends are” can arbitrarily claim those data points as necessary.
Did people directly add permissions to CA on their accounts? I got the impression they were mislead and wanted to add some different applications with different features.
An app to help you find out "which Game of Thrones characters you and your friends are" can arbitrarily claim those data points, and then use them to discover which Game or Thrones character you and your friends are. On that case, even storing the data looks like a violation, even more sharing it with anyone.
