Why wouldn't they? It's their business and you have the option of not doing business with them.
There's of course the way of other people giving them your data such as photos of you - but that's illegal and against FB TOS.
It's not "consent" as understood by GPDR and ePrivacy. You had no recourse not to give it, therefore it was not willing and informed. Implied consent ("agree or leave") is not deemed sufficient by GDPR. According to the law you can't condition the service you're providing on collecting unrelated (to that service) data.