Then you don't understand the most fundamental thing about the GDPR: "Kopplungsverbot" (german privacy law had that for ages before GDPR). You can't force someone to consent to marketing because he wants to use your service. Everything that is not part of the core service needs consent that can be withdrawn at every time. The core service of facebook is access to the network, not that my data is processed to show me better advertising. The advertising is in facebook's interest, not mine. "But we make our revenue from ads" is not a valid explanation. If your service was "sign up to see better ads", then that would be your core business and no consent needed. Best thing ever happend.