Not true. They make money by monitoring their customers' online activity and using the data to target ads, which they sell to advertisers.
I can't take anyone's reporting or opinion on FB and Google seriously if they don't understand this extremely important distinction.
That's only half the truth. In real-time bidding system, personal identifiable information is actually sent to advertisers at scale.
It's not directly selling the information, but advertisers who make generate too little revenue can't participate in those RTB platforms, so there is effectively a minimal amount that advertisers pay per potential click, so close enough to actually selling the data.
If you can target with enough granularity, which is fairly typical of these modern ad networks like Facebook/Google, then you have the data about those users who click through by the fact that they saw that targeting. It may not be perfect data, but it's close enough to be incredibly valuable to companies.
I can't buy an email list from Facebook with salaries attached, but I can target those who have a salary in the range I'm interested in and see who I get through.
You're right that this is a distinction, but I think it has very similar outcomes.
I don't care about being shown ads for products I might buy. I care about targeted disinformation being fed to "persuadables" in order to affect massive political upheaval (current political breakdown in the United States, Brexit in the UK, other instances all across the globe in smaller nations.)
The only important thing here is that e.g. Facebook has the data and sells access to nefarious actors. Selling the data "directly" or not isn't the point.