How are merchants and Facebook getting your MAC address?
FB used to also websocket portscan your localhost + LAN on login from a fbsbx.com domain that also attempted to load native code/windows media player playlists/SWF/Java/Shockwave
That's straight up malware behavior.