To be fair, most tracking is just a way to create large amounts of anonymised big data, that is both of very little risk to individuals and very profitable to sell (Allowing companies to host websites without charging users for access, or allowing cheaper costs of access), and the analytics aspect is very useful to engineers and developers for improving their products and delivering people more reliable services and such. Pretty sure under GDPR data can only be sold and traded if its anonymised (Originally EU law but now applied very widely, and essentially applies to the whole internet as any company that has European customers essentially has to adhere to it).
Of course, there's a very different side to tracking and data collection, which is that done by organisations like the NSA and GCHQ, that side is definitely a mess of morally nefarious uses, but I'm not sure there's much we can do to "protect" from them, anyone with a mobile phone contract or who has bought a SIM card or internet access with anything but a stack of unmarked cash while in a full mask, they can probably get to if they wanted.
Afterall, you can "fingerprint" people on the internet using purely the easily accessible information provided to any website, the combination of hardware and software, including version numbers, display resolution, ect, someone uses to access the web end up being pretty unique from person to person. You can then track the movements of this fingerprint across the internet, and after a number of sites, it would start to get quite easy to ID you as an individual based on your observed browsing history and fingerprint.
There is of course also ways to try to fingerprint people using the safe, legal, "anonymised" data discussed at the top of the post too, but of course nowadays techniques are often deployed for anonymising data more robustly and it's something companies have gotten a lot better at, especially thanks to regulatory pressure from the GDPR and such. Ultimately our biggest risk is private companies f'ing up with handling our data, something they have a very bad track record with, but people and states are becoming far less tolerant of it.