It is through advertisement/promotion deals, and through selling user data. However, to quell some concern there, in almost all cases that is aggregate data that cannot be traced back to the original user. Think keyword searches and a breakdown of active users from specific geographic locations at or around certain times of day.

I work for a company that is processing similar data. . .we are forbidden by contract from targeting or identifying specific users from the data we're given, but can use it for market research, for example, to know which products to push. That isn't to say though that people have always abided by these contracts.