-Could qualify as a data breach from Facebook (state law)
-Could be criminal or civil fraud - by Cambridge Analytica & co, not FB
-Could be a CFAA violation - also by CA, not FB (HT @markpmckenna)
-Almost definitely open for FTC action - all parties
FB may have a valid claim that this isn't a technical/legal "data breach." It's certainly what I would claim if I was counsel for FB. Still other legal & ethical issues at play though.