Which is against Google's terms, but of course they don't police it because it's their way of selling user data without explicitly selling user data.
Collectively the participants use this data to optimize their future bids and other surveillance/marketing efforts outside the Google ecosystem.
I'm sure Google would prefer there not be any parties involved that are purely leeches. But they may not be able to or may not care enough to tell the difference between leeches and parties that are still working out their infrastructure and bidding strategy and will begin bidding eventually. Or perhaps making a certain number of low bids you don't intend to win is what keeps you in the game.
For example, before the GDPR you would receive the full IP address of the user and the visited webpage URL.
123.456.123.456 https://www.youtube.com/watch?v=vNvlZg_zh1s
Now you receive only:
123.456.123.0 and more limited information about the context
Though this better privacy has a cost, because it means less revenue for Google, but also less revenue for the publishers, and less relevant advertising.