Thanks for the pointer. That was somehow enabled even though I locked it to private mode, and disabled the iOS level ad tracking bullshit.
The tricky part, though, is that even with your client-side settings and privacy tools set up 100% right, any company that has your info can still send it to Facebook server-to-server, with "Conversions API."
https://themarkup.org/pixel-hunt/2023/08/02/help-us-investig...