You probably could use this type of granular targeting described, and infer personal data from Facebook users using UTM codes on your campaigns. But it doesn't

You probably could use this type of granular targeting described, and infer personal data from Facebook users using UTM codes on your campaigns. But it doesn't tell you who this information is about. You'd have to trick the user to reveal their identity on the attacker website. I guess this could happen if the victim had previously visited the attacker website and identified themselves using say their email. Store a cookie of this user. Then when the click the information leaking ad they identify themselves on the attacking website with this cookie. Now you can link the information leaking targeting with the user and potentially leak data. It's misleading to say that Facebook is selling data to advertisers. Rather they might leak personal data through covert channels.