Well, they went from allowing you to have a private profile (ie. not searchable and non-friends see no info) to making name/age/gender/profpic/email/friends list public. There's quite some evidence that Facebook is using private messages in targeted ads (meaning the ad buying now knows private information about you).

Please don't mislead people. Ad buyers do NOT receive any private information from Facebook users when they run an ad. They tell Facebook what kind of user they want to see their ads, and Facebook shows the ads to those particular users. There is no exchange of information.

Pretty much what Beagle said. Targeted ads on Facebook are the social network equivalent of a spear phishing email. It's trivial to target a very specific set of even just one individual if you've done your research and then follow them around the web

Not directly, no. But at least in 2010 (last time I did anything to do with ads), you could buy the ad according to your demographics on facebook, and then plant a cookie to correlate to other sources of information.

So, yes, I was able to use facebook to mark specific people (by buying an ad that targets them), and then follow them around the internet by participating in real time bidding on their views.

So even though facebook does not directly sell that information, you don't have to be very smart to indirectly "buy" it from them (and AdNexus and friends).

Have you ever created a facebook ad?

They've apparently been targeting ads based on things said in private messages. http://arstechnica.com/business/2014/01/facebook-sued-for-al...

3 second google search yields these results from 3 months ago:

http://www.washingtonpost.com/business/technology/facebook-p...

http://www.dailymail.co.uk/sciencetech/article-2454109/Faceb...

This is pretty well known, and has been happening every 1-2 years. Are you new on the internet?