> You say that like an absolute that is enforceable.

It is possible to make it technically impossible. Not allowing third-party cookies is one way. This alone would only allow targeting by the coarse location derived from the IP and by the user agent string.