Specifically, it's by email or Facebook ID. Most likely, your friend was targeted for advertising using Facebook's custom audiences. FB let advertisers upload

Specifically, it's by email or Facebook ID. Most likely, your friend was targeted for advertising using Facebook's custom audiences. FB let advertisers upload a list of email addresses or Facebook IDs to show ads to. Personally, I consider this much further on the creepy scale than it is on the genuinely worrisome scale, more creepy than harmful. It's pretty creepy though, so.. relativity.