If there was a GDPR type law for any company above a certain size (so as to only catch the big Ad networks) that allowed the propagation of "false" ads claiming security issues, monetary benefits or governmental services, then it could stop transmission of most of the really problematic ads, because any company the size of Google is also in the risk minimization business and they will set up a workflow to filter out "illegal" ads to at least a defensible level so they don't get fines that cost more than the ads pay.

Also can you set Windows not to allow Ads notifications through to the notification bar? If not that should also be a point of the law.

Now I bet somebody is going to come along and scold me for trying to solve social problems by suggesting laws be made.

People just need to have like a barebones understanding of: computer hardware level, OS level, browser level and how permissions work between the three.

If you have that you will never get scared by a popup in Chrome.