Those issues aren’t unique to this problem. Courts already try to solve them. It’s the same as how you would find banks denying loan based on race. You find banks by complaints or wide search. You do an initial investigation from the outside with no warrant or subpoena. Like send in a white client and black client (or someone with a search history of fishing versus sewing) and see what happens. Then that’s enough to ask for all the secrets. Of course they could delete them, but that should be a big crime.

I’m not saying this is a perfect system. It’s not. But it’s an attempt the problem you describe.

Right now it's very easy to see, the companies are not hiding it at all. They send the data to third-party trackers straight from their website or application.

Disqus loads a million external resources

That’s so stupid, why not just take your OWN cookie and use it in the backend to send to all these resources, proxying through your own server or having a CNAME for theirs under your domain?

I guess it's often much simpler and cheaper to not try to hide it.

The CNAME practice is becoming more and more common. See https://blog.apnic.net/2020/08/04/characterizing-cname-cloak... or https://medium.com/nextdns/cname-cloaking-the-dangerous-disg... or https://www.laquadrature.net/2020/10/05/le-deguisement-des-t...

I think proxying or doing it server side only will be implemented later when these people will be forced to hide to save their shitty business model.

CNAME cloacking has gone even further, ad company now ask you to put a A/AAAA record pointing to one of their IPs as CNAME uncloaking was working pretty well.

I think the move will be for ANAME records. ANAME is not a real record (yet), but some providers are supporting them.

It is similar to a CNAME record but instead of storing the domain name you want to map to it pulls the A record and puts that IP as your A record.