$1 for the first user, $2 for second, $4 for third...By the 30th user, it would be painful even for mega corps. By 40th, it would be an absurd number.

Might also be worth trying to force them to display a banner on every page of the site "you're on facebook, you have no privacy here", like those warnings on cigarette boxes. These might not work though, people would just see and ignore them, just like smokers ignore warnings about cigarettes.

But these users were NOT on Facebook. It was an app using the FB SDK. So it should be the apps that use SDKs should put up large banners clearly identifying who they are sharing data with. Some of these sites are sharing with >100 3rd party sites. It is outrageous