When the Digital Services/Markets Act was written this was actually considered. But there's also companies that surveil your browsing data and sell that for other purposes not just advertisement. Market Research and such. I'd have been for a blanket ban though.

Sadly, this is mostly a matter of not enforcing the GDPR enough. Things such as "data minimization" and the erosion of "technically necessary" already should protect us. Instead the Business Community chose malicious compliance on a vast scale and the data protection agencies did nothing.