Please read the GDPR text and then tell me where it says anything like this.

I'd have to quote too much. Essentially you only have six allowed reasons for processing personal data (article 6). The only ones that could apply are (a) consent or (b) necessary for performance of contract.

(b) isn't applicable because it only applies when it's directly necessary to provide for that particular user (like processing a CC number when paying for a product). That you business model generally needs it is not enough (see the ICO FAQ on the issue[1]).

(a) Consent is valid, but it must be freely given, that is, the provision on the service can't be conditional on the consent (article 7 (4)).

[1] https://ico.org.uk/for-organisations/guide-to-the-general-da...

The GDPR talks about "executing a contract, which includes the provision of services" (not the exact wording, but something like that). So if you define "using the social network in return for having targeted ads displayed" as the contract, it is necessary.

> just that not every avenue of funding is allowed

Funding by targeted ads isn't illegal last time I checked.

Performance of the contract does not mean whatever they want it to mean. Here's the ICO FAQ on the GDPR (emphasis mine):

"The processing must be necessary to deliver your side of the contract with this particular person. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply and you should consider another lawful basis, such as legitimate interests."

https://ico.org.uk/for-organisations/guide-to-the-general-da...

> Funding by targeted ads isn't illegal last time I checked.

It is if you don't get consent. And you can't make that consent required to provide a service, since then it won't be "freely given", as per Article 7.

I'm not a GDPR expert. My work around it has been very narrow.

If this is correct, this is a major blow for US industries.

I hope the US follows suit with Europe rather than attempting to start another trade war.

What does "freely given" mean in this context? Is GDPR forcing me to give access to my service for free if my business model is targeted ads?

Yes, I that's the way I read it (from Recital 43), and the ICO seems to agree:

"Avoid making consent to processing a precondition of a service (...) If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis."

https://ico.org.uk/for-organisations/guide-to-the-general-da...