Yes, they sell data. To see how this works, start an ad campaign targeted at people who love X. People who click the ad will be directed to you. If they buy stuff from you, you have their info, and you can directly target them for more X, or sell the fact that these people like X to other companies.

This data leak is sneakier than you think. You can target X, but sell Y! Users will not even be aware that X was involved.

I can’t tell if this is sarcasm or naivety.

Some people think that Facebook, or any advertiser, that allows you to target ads using data they’ve collected but can’t access directly counts as selling it, others don’t. The former seems to be in the minority outside of HN.

Sarcaivety™

I don't rely on HN for facts, either. I buy all if mine from FB.