> They simply have websites use first party cookies, send the data server side to data harvesters, tie it all to a global user profile using either identifiers from the website or from fingerprinting and then serve targeted ads.

This is legally tricky because GDPR and similar legislation requires getting explicit consent from users for this to happen. Currently this is not very well enforced (imo) but it seems likely that enforcement will become increasingly stringent in years to come.

> They simply have websites use first party cookies, send the data server side to data harvesters, tie it all to a global user profile using either identifiers from the website or from fingerprinting and then serve targeted ads.

That honestly sounds like circumvention of unauthorized access. That's just breaking software protections.

Websites are moving towards providing md5/sha1/sha256 hashes of your normalized email (stripping the + from gmail) or phone number to advertisers.

A basically permanent ID. Unified ID2 is one version of this.

The 3rd party cookie ban and heavy pushback against alternative solutions suggested by Google just pushed advertisers into going an even worse route privacy wise.

Yes and this was pointed out on pretty much every thread about this, but it was always drowned out by the extremists. Most people on HN are extremists in this case.