Earlier quoted context omitted.
From what I gather, Facebook did have a compliance program in place to ensure that data was only shared with those that met its usage policies. Aleksandr Kogan was working at the University of Cambridge at the time, so the claim that he was using this data for academic purposes would seem credible to Facebook. Here are a couple sources that state that Kogan told Facebook that the data was to be used for academic purp…
>But it seems to me that the primary culprit here is Kogan, who lied to Facebook about the use of the collected data, rather than Facebook whose fault was being too trusting of academics. And what did FB do as due diligence? Very little. When FB discovered the breach, what did they do as a response and to mitigate the effects to the affected users? How did they recover damages and/or enforce specific performance of c…
They revoked Cambridge Analytica's access to Facebook's data, and told Cambridge Analytica to delete the data they had gathered. And Cambridge Analytica again lied to Facebook and told them they had deleted the data. That's the extent of what Facebook could have done. If Kogan broke laws - and he probably did - that's the government's prerogative to charge and prosecute him.
Likening this scenario to banks giving out mortgages that they know debtors cannot pay off is not an effective comparison. This is more like someone securing a loan by falsifying their income. In both cases the customers were harmed. Facebook users' data was used for purposes to which they did not consent, and the bank customers' money was loaned out at excessive risk. But the culprit that is responsible for this is the one that deceived the company, not the company itself. One could reasonably argue that Facebook should have been wise enough to avoid being duped, but that's still much more generous to Facebook than the bulk of the coverage I read that attempted to assign primary blame on Facebook rather than Cambridge Analytica.