You need more cooperation from the domains that do the CNAME cloaking. In fact, the CNAME just makes it a little easier to deploy - The domain server could --

You need more cooperation from the domains that do the CNAME cloaking. In fact, the CNAME just makes it a little easier to deploy - The domain server could -- on the backend, without you having any idea or way to intervene -- notify TrackerCompany that "I now see user xyz who registered with email abc@def.com first name "john" last name "smith" claiming to be 43; he is coming from ip i.j.k.l and is browsing /blah/widget/plan.html, a page about widgets" But the site owners don't trust the TrackerCompany with this much information. And the TrackerCompany doesn't trust site owners to be honest (they have an incentive to provide false/inflated data). They started eith 3rd party scripts and cookies, which was a middle ground (site owners have to work harder to lie and must leave some trail if they do; trackercompany must introduce malicious javascript if they want more than was agreed upon). Browsers are making this unusable, so it's shifting to CNAME - website owners have to do a little more work, and have to trust trackercompany more; In the trust/power balance, the sites lose power and give trust (both of which go to trackercompany). But they haven't noticed yet. So, you are absolutely right, it's just a matter of trust and convenience, which is being shifted - but ultimately, all it takes is just one call from the backend server to undo all privacy protections.