Allow some facebook supplied javascript to set a first party cookie when the user hits website.com/ad-34, and then reference that 1st party cookie the next day when the user returns. Phone home when they buy something. Facebook can now correlate (1) the ping they received to begin with, (2) the user session cookie they initiated on the first visit, and (3) the user session they observed when a purchase was made.
I'm sure things get easier with 3rd party tracking, but fundamentally you can do it without cross-site tracking.
For example, I bought a product the other day after seeing a Facebook ad, but I didn't click on the ad itself and rather went searching for it on DuckDuckGo, then after reading a bit about it online, bought the product.
I'm curious as to whether that got attributed to the ad impression or not.
Facebook (and other ad networks) want credit if someone clicks on your ad, spends time on your site, but then doesn't actually buy anything until a couple days when they enter the URL directly (i.e. not clicking on an ad). This is the problem generally referred to as attribution. Facebook (and others) do this by tracking everyone all around the web. They track the ad click and then they track you going back to the website the next day, and they know it's the same person.
Ad attribution directly depends on pervasive tracking.