That's a good point, and the distinction is subtle. I think it lies in using "their data" to describe both what pages they choose to look at, and what ads Facebook decides to show them. These two types of data should really be treated separately.

Of course, one could argue that Facebook has a right to communicate with their users confidentially. But it's a bit of a stretch to treat ads as private communication.