from what i understand about what cambridge anatyica did is
they made an app
they then paid a dollar for ppl to install the app and grant the app full privileges , then the app shared the app to all the friends of those users and then shared user stats back to the cambridge anatyica servers.
this was just was 5minute glance, i didn't really care to look.