Very good question, and a bit forward-looking. Under EU law, they are under some obligation to disclose the “logic of the processing” in cases where there are significant effects and/or legal effects on the individual. This might be the case sometimes, particularly in contexts where this Lookalike Audience tool is used for political purposes (because that is a sensitive category in EU law). They would then at least have to tell you what they use as inputs (social graph, demographics, etc). As far as I know, this has never been tried.

Observe however that a request for the “logic of the processing” has to follow a different path than the one described here, which follows the CH/US Safe Harbor arrangement (i.e. a transatlantic mechanism with free arbitral recourse). For the “logic of the processing”, you have to ask Facebook Ireland, where almost certainly you will get ignored. You then have to escalate that to the Irish Data Protection Commissioner, where I am doubtful something will be done. You would then have to sue in Irish court. Even then, they can limit what they disclose or obscure it somewhat to protect their “legitimate interests” or their “trade secrets”. Really not an impossible path, but a very hard one to follow.

I am currently trying to see how far I can go in this direction. Depending on where I get, I will publicise the outcome either here, on twitter and/or through my mailing list (signup).