Charting a course towards a more privacy-first web