The thread installs Facebook's Graph API friend permission as a public case: a personality quiz harvested a graph the platform's privacy page and public story did not treat as the product. The unresolved question is which repair, required before Graph API V1, would have kept a few-hundred-thousand-install quiz from producing an 87 million-person friend file. Taking friends out of the quiz-taker's permission is one rule. Putting the "apps friends use" control on the Privacy Settings page, off by default, is a second. Ending friend collection on the day it is announced, with no one-year grandfather and no whitelist, is a third. Those are not substitutes. Banning Kogan and taking a deletion certificate still leaves the next quiz on the same permission. A privacy-page control, with Graph API still sending friends by default, still leaves the people who never find the Applications page. A hard stop in April 2014 still leaves 2010–2014 harvests. The FTC Facebook complaint, the GSRApp complaint, and the ICO's 6 November 2018 report already record the default, the removed disclaimer, and Facebook's 87 million estimate. They do not say which one, written when V1 launched, would have kept friends off the quiz.