They had a facebook app (disguised as a quiz) that scraped the profile data of the user using it, as well as their friends. It's the latter part that was considered shady, but it was all allowed by facebook. Moreover it's not too different than similar "growth hack" tactics that other startups use to this day, eg. linkedin scraping your contacts data. Their clients being right-wing didn't help, either.