The whole GDPR thing was known years in advance and even smaller outfits would have had enough time to make changes.

An additional anecdote: we experimentally tried a smaller German ad exchange (used by quite some big-name sites here). Profits went way up compared to AdSense. What also went way up was the amount of stupid, low effort clickbait-bullshit (which as a non-lawyer I sometimes questioned the legality off considering some told outright lies). We stopped using them shortly afterward.