I think few will argue it's ethically or legally fine for my website to pay by installing a keylogger through a zero-click Chromium RCE, burying it in the EULA.

Ads don't require pervasive and invasive tracking, and surveillance that Stasi would have wet dreams about.