The Cambridge Analytics situation was more a wake up call for something that has been brewing for some time.
Two tech giants, Facebook and Google, have long been under some scrutiny for selling their user's information to pretty much anyone who can pay. Chrome tracks your activity and reports it to Google. So do searches, and Google has become quite adept at turning an IP address into an identified person. Facebook asserts in it's EULA that what you post on Facebook essentially becomes their property, to market however they want without your approval or compensation to you. They don't put it in big red letters, but it's there. Theoretically, if you mark it private, they don't do this, but they have 'accidentally' made a lot of private pages public, and the Cambridge Analytics app really pushed the envelope on private pages... it used a few mild holes in the FB system, such as a friend being public but you being private, to fill in the blanks.
We've known for some time that they're doing this, but so far, we haven't seen anything really objectionable. Originally, it appeared that they're doing it to better target ads... so what? No one is forcing me to buy anything. In that context, their data harvesting seemed pretty benign.
In past years, one might have thought that being concerned about this harvesting could be a sign of paranoia, but the Cambridge Analytics situation shows where this can lead. Now, the vast amounts of personal data they have acquired is being used for a lot more than just targeting ads.
They can establish your political views by looking at your FB page. Big deal, you say - I can do that. They can do it automatically, which means that they established (or think they did) the political sentiments of close to half the world, automatically, without their knowledge or consent. And they're selling that information to the highest bidder.
If Cambridge Analytica can establish a person's political sentiment by looking at that person's FB page, what can FB do with this information that, technically, they own? Can authoritarian regimes who frown on opposing views use the same method to identify 'undesirables' in their country or target expatriates in other countries by buying FB information? What nations would be willing to pay for that? I can think of several who would shell out a fortune for just that... and find that it's a lot cheaper than traditional spying methods.
Note that FB didn't respond to the current situation at all until a huge outcry was raised... they were perfectly happy to take Cambridge Analytica's money without looking at what they were actually doing. Presumably, they've been equally scrupulous (or not) about selling your personal information to other organizations. This isn't a matter of Zuckerberg suddenly acquiring a conscience... it's damage control after they got caught with their pants down.
And it's not a good sign that FB has to be called out before they make changes. Not the first time that has happened... With both FB and Google, they don't appear to be addressing privacy concerns until a big public outcry is raised. Which makes you wonder what they're up to that they haven't been called out on. Yet.
What the Cambridge Analytica situation has really done, is to get a lot of people to sit up and start thinking... whoa, maybe putting every detail of my life on social media isn't such a good idea after all. FB is a for profit company, not an elected government. They seem to regard privacy and misuse of information to be a PR problem to be spun once it has been exposed, not a fundamental character shortcoming that should be addressed before misuse occurs.
This is just the first example of data mining for other than advertising reasons. There will be more. There may already be more.