Facebook sells ads against anonymous user demographics. Specific Media now owns the actual profiles, with everything from sexual orientation to medical history they may contain.
Interesting question: if someone posts medical data privately, like private messages between individuals, then does the owning or acquiring firm have any HIPPA responsibility?
Maybe not, merely for owning it. But what if the owning or acquiring entity decides to sell that data to medical insurance companies, or private investigators. Are there then HIPPA complications? Because now the data is interesting because it has bearing on medical or insurance decisions.