It’s pretty straightforward and no secret. All those “share on Facebook” widgets you used to see everywhere are also tracking users. Since they’re embedded into basically every site ever, and each hit to the widget goes to facebook.com (so your browser helpfully sends their cookie along with it), that means Facebook knows who you are and what sites you visit without your consent or intervention, and uses that to sell targeted ads. They even have a profile on you even if you don’t use Facebook.

It’s changed a bit recently with GDPR, the Cambridge Analytica scandal and some third party cookie privacy stuff so it’s a bit less insidious now, but it’s still pretty bad.