I have some excellent news for you about the legality of targeted advertising under the GDPR.

The GDPR is very clear about this. Advertising is not a legitimate interest or a functionally-required data processing, ergo, it may only be done with user consent. And that user consent may not be coerced in any way at all, you may not even refuse access to services if users reject their data being used.

It's taking a while to go up and down the courts, but the days of ad-tech are numbered.