If the GDPR was really intended to forbid business models which require collecting user data for ad targeting, why wouldn't it have just said that?