One area I've heard of this being used is when companies buy lists of email addresses of people in certain industries (which is usually not illegal per se) and then upload them to Facebook's advertising platform to do targeting (rather than spamming them directly).