What would stop people using a CNAME record to point ads.example.com to a third party ad server? I don't think there would be a way to use cookies to track people across different sites, but the ad servers could still use ip addresses and browser fingerprinting to check if its the same user.