Comment by calanya

They should have notified the users whose information was leaked, as soon as they knew about it.

The 50M users whose information was handed to Kogan, and then Kogan sold to CA, should have been notified by Facebook as soon as Facebook found out.

Those users did not agree to that kind of usage of their information.