Personalizing ads per se does not need tracking or profiling. Doing it server-side and checking if the targeting works does.

the Mr Robot scandal for better or worse, was implemented almost like this

https://news.ycombinator.com/item?id=15941302