Insightful reasoning. The moat that Google built and maintains with privacy invasion is a
legal moat rather than a business moat.
A competing ad service, naturally much smaller at first, would be hard pressed to replicate[1] even part of Google's privacy-invasive targeting, due to the costs involved. Even more importantly, a competing ad service would be nigh unable to replicate even part of Google's privacy-invasive targeting, due to the legal protections and regulatory oversight of privacy. It is much easier for a large, well established business to "continue as it always did" and get either a nod of understanding, or at worst a slap on the wrist from the regulators - than for a newer, smaller player to start doing anything shady. In the later case, stiff penalties and "making an example of" can be expected for variety of reasons - the new player tends to not be well connected in the regulatory circles, and tends to be less influential on the local economy either, thus there's little downside for slapping the new player hard.
This is yet another case where regulatory framework with somewhat arbitrary enforcement (relevant fines have wide ranges; judicial injunctions are optional and discretionary) entrenches and unfairly protects from competition the existing large market players.
--
[1] sadly, ability to replicate minute features is key to provide "bullet-point engineering" and getting sales to casual buyers who are easily impressed by long feature list - and to advanced buyers who are trying to squeeze every last bit of advantage from the service.