“Advertisers, app developers, and publishers can send us information through Facebook Business Tools they use, including our social plug-ins (such as the Like button), Facebook Login, our APIs and SDKs, or the Facebook pixel. These partners provide information about your activities off Facebook—including information about your device, websites you visit, purchases you make, the ads you see, and how you use their services—whether or not you have a Facebook account or are logged into Facebook.”
For me it’s hard to believe that they admit this themselves and think that this is somehow normal. There is no lawful basis whatsoever, I’ve never given my consent to processing, nor is it necessary for performance of a contract nor is there a legitimate interest (see Article 6(1) GDPR). Besides this principle of lawfulness, you can think about the principle of fair processing or purpose limitation (see Article 5(1) (a) and (b) GDPR). Isn’t this insane?