The relevant paragraph from this article:
"Facebook now discloses personal information to third parties that Facebook users previously did not make available," EPIC said in its complaint. "These changes violate user expectations, diminish user privacy, and contradict Facebook's own representations. These business practices are Unfair and Deceptive Trade Practices."
The security flaw was ultimately patched up, of course.