No, the implicit contract is far from obvious. Yes, everyone knows Facebook shows you advertisements in return for using their service; that personal information is used for that purpose, the extent of personal information collected, and what else it can be used for and with whom it may be shared, is far from clear even to technically-inclined individuals, much less the average user.

There's a reason Facebook has you agree to a 10,000 words ToS and related documents, and it's not because the contract here is blindingly obvious. It would be another thing if the type and extent of their data collection was clearly spelled out and delineated so you knew exactly what you're giving up; but Facebook explicitly wants the ability to collect anything and everything and use it for whatever. Under those conditions, what kind of information they collect about you and what other data it allows them to infer is completely opaque. ("It's just an indoor photo me and a friend, surely Googlebook can't tell where this was taken?" https://nakedsecurity.sophos.com/2016/02/29/google-knows-whe...)