Make sending unrequested data like ads and trackers to web clients a crime akin to gaining unrestricted access to computers. No need for a new law, just a new interpretation on an older one.

Most jurisdictions prohibit unauthorized access to computer systems. What if we just say, "running Javascript code that implements functionality not specifically requested by the user is unauthorized tampering".