In this case the truth is likely to be more than either case as both of them are doing a damage limitation exercise. An educated guess would be up to 90% of the electorate using Facebook which translates to > 80% of electorate in total. If they had less, that means that the slurp bot developers would need to be sacked.
So for USA you are looking at >200M and for UK Leave referendum you are looking at >30M.
ZuckerBorg confession that 2Bn out of its 2.2Bn users have had their profiles swiped by bot at least once is a good starting point here. If it was swiped by bot, that means it entered the pool of data to be sold and reused. If we apply that ratio to the user numbers and correct for users outside voting age we will reach more or less the same result.