This whole thing would actually be technically quite easy to solve: just introduce new attribute to iframe, say f.ex. you could have traffic-limit="10MB", and request-limit="5". Browser would block the iframe and anything that runs in it cold, if it exceeds limits. In an ad-auction one would sell the ad space with the knowledge of those limits. Publisher would have perfect control on how heavy ads they allow on their page. Ad networks could still run arbitrary js. And tracking the amount of raw traffic or requests on a separate iframe should not be hard to implement.