“And several of the companies involved noted their use of such tech was mentioned within their wider privacy policies.”
Nobody reads that 4 page #7 font privacy policy. They just click the button and go on.
You mentioned the font size in your post.
FONTs do the same thing.
A web page includes a custom font for displaying the page.
Every time someone views the webpage your browser requests the font to display the web page.
Folks who use noscript can prevent this type of spying but many web pages don’t render correctly without the custom font.
Many poorly rendered web pages will still work without a custom font but you might not see the button required to complete filling out a form.
The ‘play’ button on a vid or audio is usually done this way.