Interesting that having ads profile the browser - and in many cases the ads or metrics have access to the page - isn't. I wonder if you could persuade them to drop a few domains at the router.
At home, I believe the software defined mesh routers from Eero offer a subscription with Zscalar’s malware and ad blocking DNS, 1Password Family, and VPN.
