There are many ways laws could be written to would effectively ban the current online advertising business model. One could be to require written permission each and every time a company wants to transfer user data of any kind to anyone else. Google could try keeping all Google site collected data internally but all analytics data collected from non-Google sites would be forbidden without written permission for each and every instance.
Every site would have to run their own data analysis and sell their own ads. Advertisers would be unlikely to take Google or anyone else's word, so audits would be necessary but difficult to conduct. It wouldn't completely end online advertising but would turn it back into something closer to the old traditional model where those selling ad space had a handful of semi-generic personality models for their readers/users and advertisers would select one that best matches the profile of their target customer. It destroys the economics of centralized data collection.
There are many other laws that could accomplish a similar end but through different means. The biggest barrier would be getting politicians to not care about the demands of huge tech companies that dump endless amounts of money into lobbying and campaign funding.