The law is the rub here.
At the moment, Facebook has a justified reputation for being an avid collector of any and all personal data it can lay its grubby little hands on, but at the moment it isn't doing very much with all this data. If at some point in the future (like, say, when shareholders can twist one arm behind its back and demand it maximise financial output) it decides to use this data fairly aggressively, then there is a near-certainty that legislators are going to retaliate and very aggressively enforce their citizens' right to privacy whether the citizens want it or not.
The likeliest candidate for this sort of approach is the EU, which has a known propensity for never letting gibbering idiocy, complete ignorance of what it is doing or any shade of legal competency get in the way of enacting laws on things.
The second likeliest candidate for jumping all over Facebook is none other than the USA, which is already showing quite a few jackboot tendencies, what with the Patriot Act and the recently promulgated SOPA act. No doubt similar pieces of legislation will be in the pipeline, ostensibly targeted at terrorists but mostly used on local citizens.
In short, Facebook looks valuable on paper just at the moment. The shares will likely jump a bit post-IPO, then its anyone's guess. Look at what happened to the likes of Bebo and Myspace; social networking sites can and do crash and burn with astonishing speed for the most trivial of reasons. Caution advised here.