Also the data protection authorities are there for guidance too, not just for giving fines. You don’t need to hire lawyers, you can just contact your local DPA. And if you do that, and take steps to be compliant, you’re acting in good faith.

Fact of the matter is most publishers are not compliant because most publishers use bidding exchanges and the bidding exchanges currently leak user data in a way that cannot be GDPR-compliant, even with user consent.

But in such a case it is naive to blame the GDPR. We are talking about an entire industry built on profiling users based on leaked data and that needs to change.