There are relatively simple ways to enforce this. For instance, requiring companies to register all trackers prior to use. And in that registration process spec

There are relatively simple ways to enforce this. For instance, requiring companies to register all trackers prior to use. And in that registration process specify all metadata that would be collected. Terms of service for implementing trackers in California could include something along the lines of permitting independent E2E auditing of all trackers and any software linked to it, e.g., software related to personalization and feature creation/selection/optimization. There could also be something like more comprehensive enforcement of "(meta)data flushing," including a tighter turn-around time to ensure customer data that was supposed to be deleted is actually deleted, at more regular intervals. This would better ensure novelty at the time of model training/fine-tuning. These training logs would be audited as well. Training data size would decrease. It would also act as a natural guard against data hoarding, which disproportionately benefits huge corporations (e.g., Google, Amazon). Does it make personalization harder? In some ways yes. It also challenges us to invent solutions more sophisticated than "just feed the model more data."