“If you sign up for anything and it isn’t immediately obvious how they’re making money, they’re making money off of you,” said Mr. Snyder, who maintains computer networks for a living.

Mr. Zuckerberg has said the misuse of data represented a “breach of trust” by the company. But even he has suggested that other app developers could have done the same.

Until April 2015, Facebook allowed some app developers to collect some private information from the profiles of users who downloaded apps, and from those of their friends. Facebook has said it allowed this kind of data collection to help developers improve the “in-app” experience for users. But Facebook appears to have done little to verify how developers were using the data or whether they were providing any kind of experience on Facebook at all.

The questionnaire used to collect data for Cambridge Analytica was not actually on Facebook. It was hosted by a company called Qualtrics, which provides a platform for online surveys. It consisted of dozens of questions often used by psychology researchers to assess personality, such as whether the respondent prefers to be alone, tries to lead others and loves large parties (the answer choices range from “disagree strongly” to “agree strongly”). The questionnaire took about 10 to 20 minutes to complete.

When respondents authorized access to their Facebook profiles, the app performed its sole function: to take the users’ data and that of their friends. There was no “in-app” experience to speak of; this was not intended to be the sort of cute online quiz that tells users which “Friends” character they most resemble or how their brunch preferences reveal their inner Disney princess.

Facebook has said that people who took the quiz were told that their data would be used only for academic purposes, claiming that it and its users were misled by Cambridge Analytica and the researcher it hired, Aleksandr Kogan, a 28-year-old Russian-American academic. But the fine print that accompanied the questionnaire may have told users that their data could be used for commercial purposes, according to a draft of the survey’s terms of service that was reviewed by The Times.