> I've heard them explicitly sell the information of an entire user's friends list to anyone willing to pay.

Source? If this were true and they'd do it for anyone willing to pay, where can I give them money for user's personal data?