Can they? I was under the impression that GDPR does not allow “accept tracking or else pay money”. If it does then that seems like an easy, obvious solution to the problem. So easy and obvious that the fact no one is implementing it makes me suspect it is not actually compliant.