The thing is: users explicitly allow facebook to do that when they agree to ToS, just as they allow it to store their personal photos, statuses, and messages.