They didn't collaborate with CA, they just had gaping security holes in their API that allowed CA (or anyone) to easily grab tons of data on people's friends. FB patched those holes up right away when they found out, not because they were concerned with what CA was doing, but because CA did all this without paying them for targeted advertising.