Sure, but at least native apps can only do that if I download and install them. If I do that, I’ve made a conscious decision that the tradeoff is worth the utility of the app. This limits the blast radius considerably.

On the web one is drive-by fingerprinted by sites they never once approved of or intended to visit thanks to the browser’s ability to redirect and embed without input from the user. The magnitude of the problem is far greater on the web.

To reframe it, in a given week the average person only uses a small handful of apps, but in the same span of time their browser has connected to thousands, maybe tens of thousands, of unique domains, most of which are tracking them in some capacity and the majority of which are tracking things most of us would consider invasive.