Not sure how to effectively do that, but I reckon it would be no different than the cookie mess today. Which unfortunately is, hardly ever. The big GDPR related fines can still apply. Let’s say a data set is leaked that includes tracking data that was not necessary for the service to have, then the company can receive a hefty fine. As long as the fine is larger than the reward, it might not be worth it for the company to track you anymore.