That may be true, but allowing personalised ads is something completely different from 'share my personal information with thousands of unnamed third parties', which is what this is about.

"Allow personalized ads" is on by default, which is iffy under the GDPR. Especially considering that, when it's enabled, they match you to your Google account even if your current browser isn't signed in to the Google account.

No it is not! Google requires each individual website to gather consent affirmative for personalized ads before Google will provide personalized ads. There was big issue over if Google would effectively force everyone to use it's solution as it would be the only way Google could be 100% sure the publisher isn't cheating. In the end Google allowed publishers to use whatever method they want.

But in practice, doesn't “affirmative consent” means clicking the big yellow “OK” button below a paragraph of vague weasel words instead of the little white “Configure privacy options” link, or in the case of website operators like Oath, not going three pages deep?

From parent:

> In the end Google allowed publishers to use whatever method they want.

I meant that the "Allow personalized ads" in a Google account is on by default.

It may have been at one point, but I created a new Google account the other day and haven't touched this box, and it's off.

That must be recent. Good to know!