> they're buying those from 3rd party data brokers I believe
Huh, why would they need to? The first time you load an element from Facebook (be it a like button, comments or something else) you just get a unique cookie and there's your Facebook profile. Now it's a waiting game until you log in and they can connect it to a person, or you do something else that allows them to identify you (maybe visiting friend's pages, and they already have WhatsApp data so they know who talks with that specific set of people? Idk, there's just so much data and so many options). Or they can never connect it to a person but they can still show you good ads based on that browsing history.