Do you think it’s possible to measure how many people are coming from an ad on a specific site and buying something, without also resorting to illegal tracking?

That's a good point. I think a shopping site might be able to succeed in arguing that they had a legitimate interest in tracking how people arrived on their site, but possibly not. On the other hand, if half of your visitors consent to tracking that's enough to have a pretty good sense of the value you're getting from each source.