An example I remember is when Virgin Media replaced any DNS queries returning NXDOMAIN with their own "search page" plastered with ads.

https://shkspr.mobi/blog/2021/03/advanced-network-error-sear...

Some mobile phone network carriers would inject certain PII (such as your mobile number) into HTTP request headers sent to ad networks. I'm sure they still do it, but by requiring the site to have some extra request to be made instea.

Some carriers also passed info in these headers to be used to make billing calls to the Telco, such as subscribing to premium services with minimal (if any) consent from the user.

I got stung by this years ago. An ad for mobile ringtones showed up on some news site I visited on my phone, I scrolled past without clicking. Next minute I get a text telling me I've subscribed signed up to a (iirc) $25/month ringtone plan and that it'd show up on my phone bill. It took an hour on the phone to my carrier to block the charges and get a refund. The ringtone company kept messaging me for a year that I needed to contact them and "fix" the issue.