> Can they still run A/B tests?

If I were writing the rules, I'd exclude anything that looks routing-like. "IP address A sees version 1, IP address B sees version 2, with some amount of ephemeral data involved to support pinning" is fine. Basic hit-counter type stats are fine. (though I think A/B tests are abusive crap and would love to see them go away, on a personal level, I don't think they necessarily qualify as spying, though the way they're practiced right now probably does tend collect & retain enough information that they absolutely are, but might not with some modification)

> Show you products that they think you will want to buy based on your purchase history?

No. Maybe with some kind of opt-in or otherwise making that something the user has to intentionally ask for. But if you're not using others' purchasing data to decide what those might be (and that would definitely be off-limits) then that's not very different from just having categories your users can browse.

What about, on a page about x, showing "users who bought x often bought y" ads?

It'd obviously be a tough rule to craft. In some hypothetical world where I'm the Tzar of writing and enforcing this, I'd tend to allow leeway for companies using data that could be essentially a totally-anonymous incrementing counter (as in this case) to choose how to present their site, based on what's currently being looked at or requested but not on the browsing or purchase history of a particular user. It's using a person's own activity to target, manipulate, or "monetize" them that I find especially objectionable—and the data that's hoarded in the name of those abilities, simply dangerous in ways that the hoarding companies aren't made to account for (a huge negative externality, basically). In general I think if companies want market research they should pay for market research, not just run a dragnet spying operation against their customers. If they want something other than market research out of those data, then they probably ought to just be shut down (or, at least, that part of their business should be)

[EDIT] FWIW I don't think these kinds of rules should only apply to tech companies. Physical stores ("loyalty" cards, tracking shoppers' cell phones, that stuff) and banks and similar also shouldn't be able to spy on people, nor to sell or otherwise use data collected as a necessary part of their business against people. A store may reasonably have surveillance cameras, but ought not be able to sell the footage to another company to train & test its gait-recognition software, nor use facial recognition to track how often I visit the store or what I look at. That kind of thing.

Taking cost vs. benefit into account, I would default to "no". This one in particular seems like a "neat little feature", but "neat" does not cut it if it threatens to make legislation against surveillance-based advertising less effective.

I'm not sure many customers will miss it, if they really notice. Yes it can be a bit helpful, but many other things in the world would be "a bit helpful" and yet are nowhere near justifying their cost and effect (e.g. we stopped using radioactive chemicals in substantial amounts for everyday products very, very quickly).

I've gotten useful leads on products to research maybe buying from those type of ads before, but I only ever see them on sites I've whitelisted in my adblocker specifically because they're sites I buy things from (and a rare few sites I trust to be respectful about advertising placement). They're useful when they're done right tho.

I'm confused by your ad blocker comment, because most listings like this won't be recognized as ads. They look like product suggestions, and they are entirely first party.

(On the other hand, I think the law as you're proposing it would cover them)

A/B testing can be done without collecting any personal data.