If users are compelled to view ads than websites should be liable if those ads violate privacy laws or distribute malware.

My infrastructure is my infrastructure. If i choose not to pass certain data, then that is my decision. There is no way in which i can be forced to pass through certain data on it. Contracts and TOS may require access to certain data locations in order to function correctly, but this does not absolve them from enforcing it. Sorry, but my current DNS resolver does not work very well with certain data points that just want to show me ads :)

Or funnel to fraud/scammers. But ad companies and publishers should be liable for those things regardless. The choice to "scale" by not vetting any of their business partners is theirs.

If they’re using a dynamic auction mechanism then you can fairly safely assume they’re violating European privacy laws.

Depending on the jurisdiction; they are.

That's a very good point.

In Germany they would be.