Despite the growing international conversation on general data protection, vis-à-vis regulations like the EU’s General Data Protection Regulation and California’s Consumer Protection Act, online privacy is at risk. How should users protect themselves from surreptitious online tracking practices? What, according to the individuals who are being tracked online, are considered socially acceptable tracking practices? How should researchers inform policymakers on where laws intended to protect our privacy are falling short by those entities who are supposed to be regulated (i.e., supposed to be protecting our privacy)? In this talk, I will review my prior work on building tracking-blocking tools, canvassing participant opinions on tracking ecosystem norms, and synthesizing research efforts to measure legal compliance.