If you are able to identify a unique user from its browser fingerprint, then it's personal data: GDPR applies. And for ad purposes, consent is pretty much required.