There is an easy to prove that they do read private messages. Send a private message with a link that points to your private website. Wait a few minutes and you should see in your server's logs that Facebook's bot is trying to crawl that url.

True, but they also show a preview of the page in the message, which would require fetching it. Pretty much every messaging service does that now. Also, there are legitimate reasons to scan URLs (malware, for example). Again, not trying to defend Facebook or absolve them of violating privacy, just saying that for these specific criticisms, there are technical explanations.

If you're scanning the URL for malware, why wouldn't you pick up some data mining info for the involved users while at it?

Because that takes (a lot) more effort, and you're on a schedule?

Yeah but you make money if you do, even if you spend the resources. This is not really a convincing answer.