That doesn't change the fact that the current implementation is user hostile. There's no reason that privacy laws couldn't enforce a user setting at the browser

That doesn't change the fact that the current implementation is user hostile. There's no reason that privacy laws couldn't enforce a user setting at the browser level that websites could access in a standard way. Similar to the "Do Not Track" header, but actually enforceable. That would be the user friendly approach, but would require a technical committee of browser vendors, advertisers and tech giants to be part of the design process. Unfortunately the reason this doesn't happen is because the technical team would be working against their own financial interests, so there's no incentive to stop exploiting the user. Which is why the modern web is hostile to the user, and likely won't change unless the business models drastically change.