The revelation that 50 million people had their Facebook profiles harvested so Cambridge Analytica could target them with political ads is a huge blow to the social network that raises questions about its approach to data protection and disclosure.

As Facebook executives wrangle on Twitter over the semantics of whether this constitutes a “breach”, the result for users is the same: personal data extracted from the platform and used for a purpose to which they did not consent.

Facebook has a complicated track record on privacy. Its business model is built on gathering data. It knows your real name, who your friends are, your likes and interests, where you have been, what websites you have visited, what you look like and how you speak.

It uses all that data to make it super easy for its customers – advertisers – to target you.

On the other hand, Facebook very much wants to keep that data – its competitive advantage – to itself, and so guards it carefully. Facebook has yet to face a major hack like Yahoo, Equifax or LinkedIn.

So protective is the site of its user data that it makes it very difficult for scholars to study its impact on society.

Unfortunately for researchers, the newly reported misappropriation of data is likely to make that even harder. The 50m user profiles were harvested by a Cambridge University researcher, Aleksandr Kogan – separately from his work at the university – but passed to Cambridge Analytica for ad targeting purposes – a violation of Facebook policies.

“This is about a company breaking Facebook’s terms of service and going rogue,” said Sarah T Roberts, a UCLA assistant professor of information studies. “That’s a pitfall that will exist no matter what policies are implemented.

“But it could be used as an excuse to clamp down on research – especially research that’s critical.”

Catherine Brooks, of the University of Arizona’s school of information, said: “This is going to have a chilling effect on Facebook’s motivation to share data with scholars.”

The incident could also make it harder for researchers to find people to willing to hand over data.

“People who consented thought it was for science,” said Casey Fiesler, from the University of Colorado Boulder. “That’s a really big deal. Will people stop wanting to participate in studies?”

It is not clear what the legal implications are for Kogan and Cambridge Analytica, and for Facebook, which discovered the unauthorised use of its data in 2015.

Kogan has denied he did anything wrong – so has Cambridge Analytica, which issued a statement on Saturday in which it said it fully complies with Facebook’s terms of service.

“Facebook is trying to walk the line between saying that it was not a breach so they aren’t liable, but at the same time they are saying that the data use was unauthorised,” said Tiffany Li, resident fellow at Yale Law School’s Information Society Project.

“It’s an interesting legal strategy, but whether it will work for them is another question.”

There remain ethical questions over whether the company should tell individual users if their data was exploited – as it did for those who liked a page created by Russia’s internet research agency.

“Like with the emotional contagion study, people are going to want to know if their data was included,” said Fiesler.