Ziemlich wahrscheinlich sind bei dem ganzen Cambridge Analytics-Desaster auch private Nachrichten und nicht nur quasi-öffentliche Statusupdates übermittelt worden.
For the users who did install the app, potentially their entire mailbox history was uploaded. Those users, however, would have been explicitly notified – through a simple clickthrough panel listing all the permissions they were handing over – that they were granting mailbox access.
LOL.