Facebook must offer users the choice of blocking the combination of their information with third-party data.