Those are all vendors that get access to cookies and traffic. The point is that data flows through plenty of companies are various levels and providing a CMS or

Those are all vendors that get access to cookies and traffic. The point is that data flows through plenty of companies are various levels and providing a CMS or CDN is no different than providing ad serving. The real issue is whether your data is more protected, and with first-party serving (and all the other anti-tracking restrictions), it's isolated to each domain instead of the cross-site tracking we had before. It's basically a user-to-site connection only now, regardless of the backend tech they use. Any serious privacy change would require regulation as you noted, GDPR and CCPA in the US will provide the real protections soon enough.