Earlier quoted context omitted.
CA used deceptive practices to collect user data, & downloaded personally identifiable information for u users and their friends without notification or consent, unlike NYU. Those are significant differences.
CA didn't do any of those things. They purchased some data an academic had collected from a FB quiz app. There's absolutely nothing stopping one of the NYU academics from selling the data they collect for their study to "Cambridge Analytica 2.0" in 12 months. If that happens, which FB would not be able to stop, this situation become identical to the CA scenario. There would be no significant differences.
One was explicitly installed by the user, the other was foisted upon the unwitting user.
So, maybe some significant differences, depending on your POV.