Facebook doesn't have to be the one doing it - a 3rd party that controls an app on users' phones could be selling transcribed data to companies that want to run individually tailored ads on Facebook.