Simply make it illegal to base the choice of what ad to show on any data derived from the person accessing the content. The same content accessed by different people from different locations should have the same ad probability distribution. You can still do old-school targeting by associating static content with certain types of ad a priori, as long as the shown content is independent of the user and not generated from any user data.