The New York Times should be ashamed of itself. Facebook let companies like Apple integrate with their platform. To do so, these companies sent the same sequence of bytes from your mobile phone to the Facebook server, as the Facebook app does, or as any person can do. I can write my own Facebook app today, and there is nothing that Facebook can do about it, except sue me. THAT IS A GOOD THING. LITERALLY FIVE MINUTES…
The NYT article says that Facebook told them that some partners stored that data on their servers. I note that this Facebook rebuttal does not refute that point in regard to the device partners. (Which could be a possible confusion or misleading quote in the NYT article, conflating all partners with the device integration partners, so I'd like it to be clarified somehow)
However, as you say, it is not clear at all. If that is the problem, the New York Times should write an article about that, not 5000 words of all kinds of insinuations, with the goal, it would seem, to generate the maximum amount of confusion, least amount of education, and thus the most amount of outrage.