That app collected data on many more than just US residents so more than just US legislation applies. This is one of those pesky little problems of doing stuff 'on the internet', especially when you start doing stuff that is purposefully or accidentally illegal.
Besides that they apparently also used similar trickery in their consultancy for the Brexit side.
