More like “hospital websites are sending sensitive medical information to Facebook”
This isn't a case where a tool made for legitimate purposes is being misused, it's a case where the tool has no legitimate purpose.
You can track advertising effectiveness yourself by having all your ads point to a unique URL with some query parameter (“campaign_id=123”) which preserves the privacy of everyone. FB can stalk their users on their own properties but at least non-FB users are protected from it.
OTOH with that knowledge Facebook might probably want to filter certain keys and values