Facebook can create a demographic profile of its users by observing (spying) on users' browsing behavior. Advertisers will pay more for targeted demographics, e.g. women over 40 who read Martha Stewart and travel often.
For those with their own ad network the obvious benefit is in better targeting of customer's ads to users. The more clicks they get the happier the customers are and the more money they make from their cut of the ad spend.
They also provide a lot of tools to view and examine the data to the advertisers so they can tailor their ads in some way. Most of the times you click one of these ads your user_id or email is sent to the advertisers and they can make pretty good use of that data as well.
That's the obvious one but they also sell the data to market research companies who analyse it and package it up for resale as "customer engagement profiles" or some other euphemism for poorly anonymized user tracking data.
I have no experience with Facebook here but with Google and Yahoo there is an understanding between big advertisers and their account reps about API abuse. Someone's personal credit card rents a few VPS's and some perl scripts start pulling in everything they can and even if they go over the API limits by a few orders of magnitude they never get blocked.
For any ad network or other service provider who has a resource like an ad unit or a like or +1 button everywhere on the web and can track people, the user tracking data is a major revenue stream, both for internal use and external.
Theoretically, fine-grained targeted advertising is the money. To get to that fine grain, you need lots of Stasi-like data. That's the tough part, unless you're FB. The other half (algorithms) can be continually iterated and improved by throwing math/CS/physics PhDs at the problem.
Ad networks, research companies and domain parking companies will kill to get PhD's on staff to do those kind of optimization problems.
They pay well but the good ones never stay long as the job is pretty boring for someone with those skills, it's really just a few problems that need to be solved over and over to the 10th decimal place because slight improvements in results mean lot's of real dollars.
Facebook has a shit-ton of information about you already. It knows your social graph, it knows what you "like", it knows your name, it knows your relationship and job status, it knows your religion, it knows your age, it knows your education, it knows your phone number and address. These are things you may have explicitly told it. It now also knows a significant fraction of your browsing history. Web-savvy folks with a solid business sense know how that sort of information can be easily monetized.
Consider what Facebook can easily determine from the information it explicitly knows: your income, debt level, and credit rating; your family size (and stage); your job satisfaction; your relationship satisfaction; your hobbies; your fetishes; every single one of your buying patterns. Facebook can not only determine a better set of ads to present to you on facebook.com it can resell information elsewhere to others so they can present better and more effective ads/deals on potentially every site you visit and offers you receive in the mail and through other mechanisms as well.
A hypothetical example: facebook is able to determine that you are a gainfully employed person with a much higher than average income and no children, they can also tell that you "like" a lot of things about motorcycles, you visit motorcycle news sites and web forums several times a week, you visit motorcycle manufacturer pages often. How valuable is that information to a local motorcycle dealership?
For those that are worried about it(which should be pretty much anyone) this is an extension that claims to block all other sites from gleaning your fb credentials. Probably a good idea to do. The code is on github if you want to extend it.
