According to the NY Times, Facebook's Social Ad platform may be illegal in New York under a 100 year old privacy law that states that "any person whose name, portrait, picture, or voice is used within this state for advertising purposes or for the purposes of trade without the written consent first obtained" can sue for damages, and doing so is a criminal misdemeanor.
Facebook unsurprisingly are suggesting this isn't the case, arguing that William McGeveran, the professor at the University of Minnesota Law School who came to the illegality conclusion, is taking the law too broadly. Facebook say that it would be difficult for someone used in these ads to argue against the use given they will have already identified themselves publicly, implying consent.
Whilst the lawyers can sort out the legality of Facebook's advertising program now, the real risk for Facebook is that given the growing backlash certain jurisdictions may enact laws that outlaw Facebook's program. Concern about privacy online isn't new; who doesn't remember the Government mudslinging when Google launched Gmail. The question is whether States or even the United States Government will care enough to do something about it. The chances are unlikely; law makers are far too busy trying to pass laws that would see the US Government sue Bit Torrent users to care about the privacy of those very users, but you never know.