You could easily do that for logged in users without using anything more than a session cookie to track that they are logged (which was allowed). Tracking non-

You could easily do that for logged in users without using anything more than a session cookie to track that they are logged (which was allowed). Tracking non-logged in users across multiple sessions is obviously not allowed without consent, but that is exactly the type of non-consensual privacy invasion that the law is intended to prevent.