Currently, Facebook works with six data partners in the US: Acxiom, Epsilon, Experian, Oracle Data Cloud, TransUnion and WPP. For the most part, these providers deal in financial info; ProPublica notes that the categories coming from these sources include things like "total liquid investible assets $1-$24,999," "People in households that have an estimated household income of between $100K and $125K and "Individuals that are frequent transactor at lower cost department or dollar stores." Specifically, the report notes that this data is focused on Facebook users' offline behavior, not just what they do online.
To be clear, the majority of the information that Facebook gathers comes directly from how its users interact with the site: ProPublica found that of the 29,000 categories Facebook provides to ad buyers, only 600 of them came from third-party data providers. But the catch here is that it's very difficult to opt out of having these providers share your data with Facebook. You'll have to contact each provider directly, and the process can be complex, buried behind pages of legalese.
For its part, Facebook says that it doesn't need to inform users with detail on how it uses third-party data services because they are the ones doing the tracking, not Facebook. "Our approach to controls for third-party categories is somewhat different than our approach for Facebook-specific categories," Steve Satterfield, a Facebook manager of privacy and public policy, told ProPublica. "This is because the data providers we work with generally make their categories available across many different ad platforms, not just on Facebook."
If you're the type of person who wants to keep your information as private as possible, you're probably not on Facebook anyway. But as the platform gets more and more ubiquitous, it's good to know just how your personal information is being used -- and how to opt out and keep your personal information under your control as much as possible.