First, I would sooner support the criminalization of misrepresentation of web traffic as human when it is actually a bot than I would allow companies to de-facto require bio-authentication on approved hardware+software stacks to participate in online life. Let the courts sort it out from there. Second, it's not my problem if some website's business model doesn't work anymore, and I resent them trying to make it my problem. If a website is offering a vital service then it is access to that service that needs to be preserved, not whatever company happens to be offering it, especially not if the cost of keeping them solvent is giving up entirely on privacy rights.