When it comes to ad tech, high risk transaction sites and possibly even big forums, device fingerprinting is a common practice and is indeed controversial, not least due to potential enrichment of data from third party sources, making it very easy to form a unique identifier.
(Source of info = friendly forum admin of big board who I complained to about a mistaken identity lol - we got into a webmaster discussion as i owned my own forum at the time)
Many won’t be transparent about this practice in their privacy policy or even where they are, many users don’t bother to read privacy policy these days
Heck - it’s entirely possible site owners themselves may not be fully aware of what data is collected - as per device fingerprinting solutions lots of information is aggregated from device identifiers, IP, location etc and potentially enriched from third party data sources to “profile” users
The other controversy lies in whether users should have to opt into data collection, or whether the onus is on them to read privacy policy.