Just to check, because I’m no longer sure:

Is this real?

Not sure how to effectively do that, but I reckon it would be no different than the cookie mess today. Which unfortunately is, hardly ever. The big GDPR related fines can still apply. Let’s say a data set is leaked that includes tracking data that was not necessary for the service to have, then the company can receive a hefty fine. As long as the fine is larger than the reward, it might not be worth it for the company to track you anymore.

Which is why I had hoped the EU would ban all forms of fingerprinting and non-essential data tracking. But they somehow got lobbied into selecting cookies as the only possible mechanism that can be used, leaving ample room to track using other methods.