> Ad-supported websites are probably the most common case here, even if the sites don't store any data themselves.
Internet advertising is a viper pit of privacy invasion. They didn't get their house in order, and let it turn into the horrible mess it is today, so they shouldn't be surprised that the regulators stepped in.