I think web servers monetizing any user identifiers possible should be assumed by this point in the web's evolution, and precluded to the extent possible at the protocol level.

No one is going to say "Oh, we've got micro-transaction revenue now, let's do away with ad tracking." They're going to say "Great, now we have both streams of revenue."

If Cloudflare et al. are stepping into the middle of the transactions, I'd much rather scope my identity leakage to only them than everyone running a web server.