This is an utterly annoying failure of legislation. The law could have mandated that a standardized mechanism to opt in (or even out!) would be implemented by major browsers and the relevant standards, providing APIs for websites to integrate. It could have even been about that vague and still be more effective and less counterproductive. The actual legislation invites this sort of abuse. Understanding that the abuse is intentional is a component of understanding the situation. But the blame for it doesn’t absolve the law, it implicates it.

If the vague proposal I’m suggesting sounds outlandish, that’s more or less how every major browser implements other requests for intrusive APIs as a matter of protecting users. Even when they do it half-heartedly they do it by developing a standard with their more invested peers which is far less prone to universal abuse.