I do think it should be illegal, but "isn't it illegal?" was a genuine question. I don't know the specifics, but I'm surprised there isn't some legal requirement. You can't even send e-mail without allowing an opt-out, and every ad network I know of has an opt-out policy, so sending tracking information to every website you visit and selling that information with no option to opt-out just seems over the top and out of step with what everyone else offers.