> They simply have websites use first party cookies, send the data server side to data harvesters, tie it all to a global user profile using either identifiers

> They simply have websites use first party cookies, send the data server side to data harvesters, tie it all to a global user profile using either identifiers from the website or from fingerprinting and then serve targeted ads. This is legally tricky because GDPR and similar legislation requires getting explicit consent from users for this to happen. Currently this is not very well enforced (imo) but it seems likely that enforcement will become increasingly stringent in years to come.