Facebook who have the ability are not necessarily criminal.

It is the websites that invite them into a secure context that are often illegal.

In the physical realm, is it okay for an advertising company to be invited into a bank safe or customer records storage without any business controls to audit, monitor or check their actions? Same is true on websites.