You just contradicted your claim that no privacy violations would occur.
You say no privacy violations "were going to result from this type of information-gathering". However you then concede that it resulted in a "privacy leak in that they showed Facebook users from her high school her picture," mentioning several reasons why the target may find this invasive. You frame it as "unintentional", but that is irrelevant; you've contradicted your claim.
I would certainly not argue that the critereon is intent to do physical harm, which is how you define "stalking". Boy, would an awful lot of stalking no longer be considered "stalking" under that definition. By your definition cyberstalking is ok if you only want to date them and/or joke with your bros about it, not rape someone.
Rather the issue is whether the actions of, say, posting your photo in a Facebook ad campaign -- and otherwise pursuing means of "information-gathering" so extraordinary that one needs to post to Hacker News to explain them -- might reasonably considered a willful invasion of a person's privacy. Certainly it could be, and these guys just didn't care, because they're just having a laugh, and she's probably cool with it, and if she's not, well screw her because girls should be cool with that sort of thing.