Check for yourself (This link also deletes your data from them if you're so inclined.): https://datacloudoptout.oracle.com/registry/
Their pitch involved bringing roughly 30 people into a room for three of them to do demos/presentations/q&a. Definitely the shock and awe approach. Unfortunately for them, we weren't totally clueless. The claims they made about their data and what it would do for us were pretty laughable.
I don't know whose idea it was to let them pitch us but it was a total waste of a day.
The way it works is not very different from custom audiences, but they are syndicated to every FB marketing api user instead of private to your account and there's a revshare with FB based on usage.
So the matching has to be based on one (or more) of the keys listed here: https://developers.facebook.com/docs/marketing-api/audiences... plus a few extra ones like IDFA/IDFP, probably cookie matching, etc.
It's not hard to create a massive audience on Facebook if you're matching on public data like postcodes, but ultimately your understanding of that audience is based on how accurate your data is. Whether you believe that data companies have accurate data or not, it has nothing to do with their segment size on FB.
PS. the partner categories program has actually been discontinued as of April 2018, so these third parties will no longer be able to syndicate their data to all FB ads users in the future.
One thing to point out is that it's true that the Partner program itself has been discontinued, which gets rid of all the 3rd party targeting categories within the self-service interface using Facebook-managed data integrations with those firms.
But the ToS[1] rewrite effective 5/25/18 goes out of it's way to ensure that they don't outright prohibit the use of third party data. They just effectively decentralized the usage of it and require ad buyers and the data brokers to have a direct relationship now, and leverage the custom audience functionality you mentioned to do the targeting. And in so doing allowed themselves to become willfully blind to the usage of 3rd party data plus shifting liability onto the advertiser for usage of it.
It's not something a web dev will generally need to worry about but for working class blue-collar citizens this is a real nightmare they unknowingly facing.
If insurance companies and employers use that information (as well as creditors) it become subject to the FCRA; as well as subject to state, local, and federal laws about lending, insurance underwriting, and employment. This information merely existing (for advertising purposes) doesn't suddenly make it legal to use it in specifically illegal ways.
For example, it's a standard practice to use a person's credit history and credit score during insurance underwriting - data shows people who are responsible with credit have less claims, so they have lower premiums. However, say you live in Massachusetts. In Massachusetts it's illegal for insurance companies to take your credit history and credit score into account when determining policy premiums. So insurance companies are not allowed to access your credit if you live in Massachusetts even though that information is widely available and used in other states.