As I wrote in my response to pif above [1] it's pretty likely that the GDPR also requires consent for detecting ad fraud, without which advertising isn't practical on most sites.

[1] https://news.ycombinator.com/item?id=34248454