This too is my assumption. Even if someone says "no it means the data is not collected", I would not be satisfied with an answer here, though. It's something very hard to prove one way or another.
The controls do not work.
If you're seeing targeted DLCK ads while visiting some site, it's because the site has semantic information on you and has told Google "This user looks like they like puppies; I know this because they read a lot of puppy articles or I have a social media arm and they joined a puppy message group that I manage accounts for. Get that user a puppy ad."
Now, how individual sites track you and unify their concept of your session with their concept of your ad targeting is up to them, but it's worth noting they're allowed to use basically anything (including first-party cookies, browser thumb-printing, and local store API) to do that. They can also share information with other sites (using mechanisms like image bugs to let an affiliated site know you visited their site and what your userID is on their site, so they can compare notes later and build a comprehensive ad profile for you). None of this requires Google's involvement.