Individual sites are not really the ones auctioning ad inventory that is targeted by a user's cookies. That specific technology continues to become consolidated in a handful of exchanges. You could probably get 95%+ of cookie-targeted impressions compliant by regulating 5 or 10 companies.