Interesting analysis! I wonder how this would affect AMP articles. What happens when a one-time visitor (from the publisher's perspective, but not from Google's perspective) looks at the cached AMP version of the page on Google's servers and Google's domain? Ads and tracking could hosted by Google as well (AdSense + Analytics), so everything is technically 1st party.

Wouldn't Google be the data-controller in that case?

Google might still be allowed to do the personal tracking if they ever obtained consent from that user. Another reason why the AMP caching is bad for the web, I guess.

And from the user's perspective AMP articles would become even more appealing because they would never be bothered with consent popups.