I also don't understand how this can be in legal in the sense of the GDPR, but AFAIK there are multiple German news sites which use this pattern (e.g. Golem, Heise and Spiegel from the top of my head).
I don't care much about this case in particular, because I don't use their pages much anyway, but from my understanding, the correct approach would be, to simply use ads without tracking for the people who don't consent.