I don't understand how these records were sent, and how it was confirmed they weren't deleted. It can't be tracking info, Facebook doesn't give access to such

I don't understand how these records were sent, and how it was confirmed they weren't deleted. It can't be tracking info, Facebook doesn't give access to such things outside the company, so the authors wouldn't have been able to confirm the records sent were still available. Also, technically the pharmacy wouldn't be sending those records, the fake user's browser would be sending them. If I had to guess, the fake pharmacy created "Custom Audiences" -- lists of identifying info, like email addresses, that Facebook can use to serve an ad to a specific person-- and labeled them as people that had purchased some specific drug. You can name these whatever you want, and can read their contents. API docs here: https://developers.facebook.com/docs/marketing-api/reference/custom-audience https://developers.facebook.com/docs/marketing-api/reference... There's no complex tagging system, it looks like name and description are the only places where you could say this is a list of people that bought a specific drug.