"absolutely necessary" does not mean anything. For example, tracking in banking systems has very good justifications such as fraud detection. That alone means banks have a blank check to connect tons of features about their users, and not for nefarious purposes.
[EDIT] to your EDIT point: even with server logs you could start building user tracking and if your net is large enough you can derive a massive amount of data just from that. Pattern analysis, sites/services users connect to, geolocation, etc... even without the most sophisticated tracking systems this is already good enough to build business value.
Cool. Can't sell it, can't leverage it against users (e.g. use it to select which products to try to sell them). If you're doing that on any significant scale it's gonna leave a hell of a trail and enough people will be involved that it'll be found out.
"waaaah but we need to share it with 'partners'" hahaha OK whatever, but bet you don't though. Illegal. Figure it out. Bet you can.
"absolutely necessary" does not mean anything. For example, tracking in banking systems has very good justifications such as fraud detection. That alone means banks have a blank check to connect tons of features about their users, and not for nefarious purposes.
[EDIT] to your EDIT point: even with server logs you could start building user tracking and if your net is large enough you can derive a massive amount of data just from that. Pattern analysis, sites/services users connect to, geolocation, etc... even without the most sophisticated tracking systems this is already good enough to build business value.