Yes paper work is required. I think OP is pointing out that that it doesn’t require the same amount of work it used to. Especially from law enforcement.
LE are mostly avoiding this by just buying from the same public ad network sources that everyone else does and using that as a way to avoid the paperwork, I know people get very pissy about EUs GDPR sometimes but if you want to put an end to that kind of thing you need to tackle the private sector collection problem which almost anyone can access and is comparable with mid tier nation state capabilities.