I have some friends whose likes I can see if I look at their timelines.
However, I can't access those likes using the Graph API. I'm returned an empty set when I run:
https://graph.facebook.com/DAT_USER_ID/likes?access_token=DAT_ACCESS_TOKEN
or
https://graph.facebook.com/fql?q=SELECT url FROM url_like WHERE user_id=DAT_USER_ID&access_token=DAT_ACCESS_TOKEN
I do have the friends_likes
permission granted.
I created a Facebook bug report here: http://developers.facebook.com/bugs/112253515590244?browse=search_50367fda9e6d48337036107
In addition to your friends' privacy settings for their Likes, there's another privacy setting which dictates how apps you use can access their data.
Generally an app you authorise to connect to your account is able to see anything you can, you're effectively delegating the level of access you have to your data and your friends' data to the app.
There's a privacy setting which overrides this though, it's under Privacy Settings -> Ads, Apps & Websites, and is called 'How people bring your info to apps they use'. This allows a user to specify certain categories of information they do NOT want to be made available to apps being used by a friend, even if that friend can access the information normally via Facebook.com
It currently looks like this
There's more information about this (written for a user audience, not a developer audience) on Facebook's Privacy information site