FAIL: Read the EULA, you don't even own the pictures you post. This has nothing to do with your privacy settings. Outside companies aren't getting access to your facebook page or postings directly. Facebook collects, compiles and sells to whoever is paying. They don't even have to give the data directly, that's worth to much money. Just postulating here, but in this case I could see the Credit Companies providing an algorithm for Facebook to run against the data and it could simply provide a return code between 1 and 100, which in turn could be used as a +/- against your FICO. No laws broken because no personal data was exchanged.
You did get to sign up for FREE didn't you? Page ads aren't what makes FB a multi-billion dollar company.