> ban all tracking That's a whole can of worms. Does the existence of things like your website's Apache request log count as "tracking"? Or does it only count

> ban all tracking That's a whole can of worms. Does the existence of things like your website's Apache request log count as "tracking"? Or does it only count if it's multiple domains? Maybe we'd need to say multiple organizations, to account for applications with multiple domains (e.g. facebook.com, fbcdn.com, etc.) But then what is an organization? If I sign an agreement with you to sell you my Apache request log, is that now illegal? If so, what was it about that that made it illegal? How do you make that illegal without also making it illegal to share these otherwise benign logs with people for the purpose of debugging website issues? Are you going to base this on "intent"? That is, "you're free to share this data with X as long as X does not intend to use it for advertising, or to share it with anyone else who might [...] who might intend to use it for advertising"? These kinds of intent-chains are spectacularly ineffective, in part because the advertising ecosystem is set up to make these chains as convoluted as possible, and suddenly someone just has some data there and why not make profiles out of it? etc. :\