The API not only exposed access to a user's freely-given data, but also data about a user's "friends" without their consent. Facebook's documentation dictated that although accessing user data non-consensually was possible, application developers should not do it. Cambridge Analytica should not have taken advantage of the loophole in the API, but the brunt of the blame lies with Facebook. Facebook developers exposed personal data not freely given by the user. They enabled the ethical breach that allowed Cambridge Analytica to build a massive marketing database and share that data with political campaigns. "The time has come for engineers to take responsibility for their creations." Vox's Aja Romano explains how the breach of user trust happened: The factors that allowed Cambridge Analytica to hijack Facebook user data boiled down to one thing: no one involved in the development and deployment of this technology stopped to consider what the results might look like at scale.