You can be targeted without explicitly selling data to a third party. This is how most large advertising networks work. They don't send a dump of all user data to a third party who wants to advertise.
They don't have to dump the data, your request for the ad is itself data that allows more targeting by that network. Part of your identity is sold by default the moment you content to the linked ad network.
That request is made to the ad platform (e.g. Google/FB/Amzn) and not the 3th party who owns the ad. Even when following the link the website does not get any personal information it does not already get by you visiting their website.
You mentioned data originally, not personal information. You do give the 3rd party data about your current visit which is connected with all the information they already have about you - which builds up your profile. But the difference is not that big - for example did you visit page for the local school with a facebook button? Yeah, facebook already knows which area you likely live in.