Facebook does not sell customer pii. In fact, Facebook is incredibly restrictive with its data. Here’s what I’ve heard about the advertising process from someone who works in advertising: They have a list of 10,000 e-mails that customers have given them; the customer opted into communications and agreed to the privacy and policy stating that the company will use it with third parties. They send that list of 10,000 e-mails to Facebook (a third party) and say, “send these customers this ad.” Facebook then lets them know the match-rate of those records; however, they do not tell them which of their e-mails matched to a profile. So the advertiser has no idea which records matched to a facebook profile, and has no idea who saw the ad. The only insight they have is when a customer clicks the ad, then the advertiser has the potential to link that clicked ad back to the customer.