The law should lay out principles, not techniques. The GDPR works for any kind of data processing, it is not specific to browsing on the Web. The core issue is

The law should lay out principles, not techniques. The GDPR works for any kind of data processing, it is not specific to browsing on the Web. The core issue is that the ~150 companies of the Oath network will effectively go out of business when they comply with GDPR. So now they try to play some games, until the fines handed out to them become too large to sustain in EU.