> They simply have websites use first party cookies, send the data server side to data harvesters, tie it all to a global user profile using either identifiers from the website or from fingerprinting and then serve targeted ads.

That honestly sounds like circumvention of unauthorized access. That's just breaking software protections.