I think the big thing is that opt-out tracking should be illegal. It's total bullshit that giant partnerships like ad choices and just collect and share tons of info about you with the flimsy veil of an opt out system[1] that NEVER. EVER. succeeds. Like this is big tech you think they don't know how to write an opt out program that actually works, they solve problems in all sorts of domains, I think if they _wanted_ it to work they could do so very easily. Not to mention that in opting-out, you have to agree to let them track you anyway with a different cookie that is supposed to keep you from being tracked.
Profiling has to be done with acording to a privacy assesment analysis and can only be done if the assesment shows no elevated risks and / or the risks that exists are taken into account and contingencys are planed for.
Yes it is quite some work and overhead, but you are extracting information and use it in a way the person could not foresee or conceptualize even exists within the data.
So you couldn't select 18-25 recently-single white female within 50km as a target category (or whatever else you come up with).
I think GDPR may already forbid such use (without consent), though the implementation is tricky.