Among other things they get access to "age range, gender, language", which in combination can often already be a good starting point. They also get access to the email address which can be used to pull more info via other APIs, if you have used that email much in the past. They also get access to "other public info", which I'm not 100% sure about, but I think that should be equivalent to what you see when you go on someones public profile page, and includes Page likes for a lot of people.