I might be late to this but it's something I discovered recently.
Let's take a fictional character and call them Joe Bloggs. Joe doesn't subscribe to all that fancy schmancy internet nonsense and has no clue what a 'Facespace' or a 'MyBook' is. He checks his email every now and then and might browse the web from time to time, but that's all he really does on the internet.
So imagine his surprise when he gets an email from some Facebook thing telling him he should sign up, because all his friends are on it. He'd dismiss it, only - it really is listing all his friends. How can Facebook know who his friends are? How does it know that Jane Bloggs is his sister and John Bloggs is his father? How does it know so much about him when he knows nothing about it?
The answer is that Facebook collects emails and search habits. You know that 'enter your email details to search your contact list for friends on Facebook' feature? Be careful with it. Facebook keeps all the addresses it finds and associates them with you. If you've got those email addresses in your contact list, they must be your friend, right? Repeat this for all the other members on Facebook who are doing the same thing and Facebook can build up a pretty good picture of who you are.
Facebook also allows you to list various family members on your profile, and if said member doesn't have a Facebook profile, it asks for their email address. Facebook then knows when someone invites you to Facebook that you're the brother of X and the father of Y and whatever else.
Am I going to delete my Facebook profile after this? I'm not sure. It is a great way to keep in contact with people I haven't spoken to in years but if it's profiling me behind my back, I'm not sure I agree with that. Facebook are by far not the first or only company to do this, of course, but they are so far the most high-profile and media attention-worthy. With millions and millions of members, they can make some hefty $$$ from all this if they really wanted to (and there are rumours that they do want to. Imagine what advertisers could do with that data!). Then again, if I did delete my profile, Facebook never really deletes a profile in case you want to reactivate it. So they've got my info anyway, whether I gave it to them or not, and whether I want it there or not. Fun.
Scary stuff, if you ask me.