I do some work for large affiliate-sites, and my experience is that the small sites monetize with links to amazon and AdSense and the large ones don't care about GDPR.

Building a privacy-first ad network would be a good thing with regards to harm reduction. We're not going to "fix" the need for all the sites wanting to monetize with ads, but if they had a less harmful option than helping Google track your every move, that would be progress.