It was not a flawed idea, but flawed execution. The law should have mandated to adhere to the user's "do not track" setting in the browser.

That being said, it was very early regulation in this field, and more recent approaches are already better, e.g., GDPR, DMA.