I agree most of the tracking and adtech is straightforward textbook illegal, and the norm in the sector.
The issue I have is the general lack of enforcement. Selective enforcement of standing laws is ripe for abuse, and creates a situation where every rational actor assumes they'll never be first to be hit, as everyone else does it too...
It seems to me right now what we need is high throughput bulk and even prosecution of each and every violator, one by one. After the first few take place, and the pace of enforcement is made clear, this will become a higher priority to the rest of the sector (who will subsequently be prosecuted for their misconduct in any case, to ensure even handedness).
Clearly there are practical issues around trying so many cases, but this is where regulators need to innovate in the same way tech companies innovate to defeat regulations. Perhaps we need hearings to establish illegality of a set of actions, and simpler fact finding hearings to merely determine that given conduct fit into that illegal set of actions. Strict liability offences (prove it was done, no need to prove fault or intent) could also help (where appropriate).
GDPR exists, and so do national privacy laws.
While this example is especially vile, let us not forget that vileness is the modus operandi for these firms, generally.