And the regulation doesn't need to be overly complicated:

* Ban targeted ads or make them opt in;

* Ban targeted content or make it opt in;

* Enforce the use of a do not track header - if the user does not want to be tracked a simple browser or OS setting should be enough.