They buy it from data brokers. Some governments are limited on what they can store where companies can store whatever they want as long as it is "legitimate interest"
It is worse because if you gpdr Facebook they only have to remove you from their data sets not their partners who scalp the Facebook datasets.