> Even if I grant him the necessity of doing things this way, as he seems to claim, that just bolsters the argument that invasive tracking is baked in to nearly everything, that you simply can't do business like this without it happening.

It's much the same problem as (among other examples) mobile device permissions.

Things have improved somewhat, but for years every Android app asked for permissions like "view and edit the files on your device". 99% of the time that was innocuous. Saving a single user setting could require creating and viewing a file. It's easy to see why devs with no good alternative would have been frustrated to hear "hey, why do you want permission to see all my stuff?!" But that didn't make it good or secure. Flashlight apps would get file permissions to save a single setting, then hoover up as much data as they could get with that permission.

The problem was precisely that the innocent, 'right' way of using permissions was potentially a channel for abuse. If people object that loading a single font from Typekit is inherently a violation of privacy, maybe they're fundamentalists. But in practice, what I see people point out is that it creates a threat to privacy, that the entire ecosystem of data access in inseparable from the ecosystem of tracking and advertising. And that's absolutely true.