by IP address may be good enough per session and each session could be tied to per more persistent IDs in cooperation with the sites embedding the ads, e.g. via the javascript loading some parts of the ads. So even if you block cookies to the ad network's domain they could still store cookies on any site that embeds their JS directly.