We all know it's worse than that.
They've not done it because people didn't say no. People *explicitly* said yes. They (me included, naturally) just have a tendency to not read what we are agreeing to.
We all know they've acted within terms agreed to, the legality of those terms is the bit yet to be decided.
When you install either FB or FB messenger on your phone, you're plagued with helpful suggestions to "let us help find your friends online" type messages (and with messenger it's automatically granted, you can say "no" to letting it act as your text messaging app, but not to the "scrape your phone" bit). Click yes and get your phone scraped for the lot. They have ALL of your contacts, texts and anything else stored on your phone (US journo recently did a data request from FB to find they had literally every text message she's ever sent). It might not be legal, but they do ask permission, in the t's and c's that are rarely ever read, and people happily oblige.