Agree about the overlap, but want to call to attention OP's requirement that I don't believe is part of GDPR:

> Targeted ads are required to include both a declaration that they are targeted to a user and what criteria were used to select the user.

This makes a massive difference! GDPR currently revolves around informed users making a request. OP's requirement would force companies to educate users about their methods. I see an analogy to the health warnings on tobacco ads.

Incidentally, as someone who thinks targeted ads can be beneficial, I think this would help me interpret and engage with "sincere" targeting.

This is a part of the GDPR - the language is so generic that I think much of this will come out in future court cases, but check out Article 21 and 22 of the GDPR which I think addresses this (but IANAL)

https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...

People can object to be profiled and can ask a person for help like: "Why am I seeing this? Please stop"

Belated thanks for the really useful link! I hadn't looked into these opt-out/review requirements before. But, FWIW, I still think there's an important difference between a user-driven opt-out (which I also don't read as a guarantee of explanation) and proactive publication of the personalization criteria. It's still possible for an uninformed individual to never even realize content is being personalized for them, much less pass the threshold of asking how.

I was unaware of the percent of revenue fine. What happens to a company with negative revenue? Seems like Hollywood Accounting could be pervasive here.

Revenue, not profit. Revenue cannot be negative.

Nitpick: Sure it can, but it's a corner case. You can recognize revenue one quarter, and have to issue a refund to a client another quarter. If that was your only revenue, you have negative revenue for the second quarter. :)

Gross vs net