Without going into deep detail about how Internet Protocol routing and the Domain Name System work, it's actually quite easy for your ISP (and in this case, your provider is your ISP) to know what domains you visit.
To answer your question, the provider maintains a list of all the IP addresses registered to Facebook. When your phone requests Internet data via its cellular connection, it addresses the request to a specific IP address. That request gets routed through the Internet gateway at your provider. The gateway (or other hardware between it and the tower) can record this usage, and check the source and destination addresses. If the destination address (for a request) or source address (for a response or push notification) is from an IP address registered to Facebook, your provider simply doesn't count that usage against your plan's data limit.
They can't necessarily read the traffic - even using Deep Packet Inspection (DPI) they won't be able to read encrypted traffic - but they can see how big it is, where it comes from, and where it goes. Be aware that mobile operators often do use DPI, though; it lets them detect people doing things like using tethered data without (or in excess of) their tethering limit. Also, while the traffic between your phone and the tower is encrypted (with not-very-good crypto on older-generation protocols, though I don't think 4g is broken yet), the operator obviously needs to be able to decrypt that layer of traffic so they can route the data. The data could be encrypted at a higher level as well, using things like SSL/TLS, but anything above the Internet Protocol level will reveal the sender and recipient of each packet.
Any ISP can do this monitoring of your connections for anything that accesses the Internet through them, by the way. This kind of "metadata" is one of the things the NSA and similar agencies around the world is so intent on slurping up. China's "Great Firewall" places filters on IP addresses that it doesn't want you to reach, though I think it also uses DPI to block specific content on otherwise-permitted sites. This kind of thing is one of the reasons anonymizing proxy servers and anonymous networks (such as TOR) exist; your ISP can tell you are connecting to a proxy / TOR entry node, but can't tell where your request goes after that unless they control the node. By bouncing the request a few times to random machines, it's possible to be pretty sure that anybody trying to track the path of the request has lost it. The actual final destination is encrypted within the data sent to the proxy, so it's never visible to a network attacker.