Advertisers can choose to advertise to customers that fall into various buckets.
Income, gender, location, recent history of viewing specific types of pages, etc.
This is what I mean by limited form of access. Advertisers do not receive user information, but are granted the ability to use it when setting up ad campaigns.
They don't sell peoples personal data at least publicly. But that makes them care even less about end users, even paying end users. Which means a business is foolish to rely on them.