Users will have to explicitly opt-in to advertising and tracking, and GDPR says you can't deny service to people who opt-out of these privacy protections. GDPR is pretty specific that you have to explain to users why you collect data, what you use it for, before you collect it, and then get their explicit opt-in to use it in that fashion.