this is the core Facebook (and google et al) business model
whatsapp and google system apps scan your contact list every two seconds (not hyperbole) and send the diff to their servers. if you are in someone's phonebook, you're very well cataloged on their systems. and those contact entries tie phone, email, name, other grouping, association list by crossing lists, address, aliases, etc.
they have to claim they don't map those identities for ad targeting, but everything else they can claim you "asked for it" like suggesting new contacts to add is fair game.
Anyone who clicks agree without reading and carefully interpreting every word of the terms of service is in fact consenting to almost anything. Almost anything you can think of could be there and you don't care.
I mean even things which are not actually written in the TOS. If you don't know what's in the agreement, you're agreeing to almost anything in principle.
The number of Facebook users who have actually read all the legal crap probably wouldn't fill a small lecture hall.