They are a man-in-the-middle between users and a sizable chunk of web and domain name servers, putting them in a position to track your behavior all over the place (even if you use an ad blocker).
And in many cases, they provide the encryption for those sites, so they can read or modify your unencrypted traffic as it passes between them and the origin servers.