But Facebook never sells the data itself, it only sells targeting capabilities. The government can only say "display this ad to people who fit these categories", but they can never see those identities.
It's always something generic like "reaching people who are over 15 and located in $country".
...then why the fuck is the ad about the exact same thing I was browsing 20 seconds ago on my work laptop or chatted about with my friend on Messenger? I've even got ads on FB properties about products I chatted on IRC with someone I've got no connections on FB with, but most likely our graphs have merged somehow.
This is easy to test, turn off all blockers and go browse for some product you normally don't look for. A bread maker or a washer-dryer combo. Then count the seconds you start getting ads for that exact type of product on FB/IG.
Company X sends event logs to FB whenever anyone visits their website. They don't know who you are, but they pass metadata that helps FB determine who you.
Company X can then specify that their ads should be shown to anyone who visited their site in the last, say, 30 days. This is helpful for businesses who want to follow up with the digital equivalent of window shoppers.
Alternatively, Company X could create a "Lookalike Audience", and have FB show their ads to people who have similar characteristics to their existing site visitors/purchasers, but are different users entirely. This is useful for businesses who want to efficiently find new customers.
Most ads people see fall into one of these buckets.
[0] https://www.facebook.com/business/help/610516375684216?id=24... [1] https://www.facebook.com/business/help/164749007013531?id=40...
“Deliver this specific JavaScript to all white men in Vermont who own a 2015 iMac 21” who predominantly browse in Private Mode, drive a Mazda 3, and have visited Real Doll twice in the last month.”
That is basically one person. Now you know their location because the JavaScript loaded a unique file from service you have access to.