IMO the hope lies in the fact that many vendors do not depend on privacy invasions in their main business model, e.g. Amazon or Panera will sell me roughly the same stuff regardless of which photos I was staring at yesterday. Selling my info on the side is a profitable add-on, but not strictly required for their main business. Maybe unnecessary tracking will eventually be competed away (this does require that a much large fraction of users starts caring about privacy).

One could also introduce confusers -- e.g., setup some "light anonymizing portals" that will add / swap / scramble non-critical cookie data. Done right it should be possible to keep almost all of web functionality intact without introducing a security nightmare, but to work well this also needs a viable business model.