You really don't have to play devil's advocate, one of them is illegal.
If a company has no viable way forward, and has to resort to what the rest of us deemed illegal, it should stop existing. Not all companies should survive at any cost, that's not utilitiatian or desirable.
I'm going to be purposefully obtuse and set up a contrived hypothetical, but to me it's really more like: you came to my store today, but I saw you at the golf shop yesterday. Maybe I watched you closely to learn exactly what you were thinking about buying. I happen to also sell golf things and maybe I want to peddle them to you. So I really go all in on my sales pitch and single you out while you're shopping. That's legal in meatspace. What makes "the same thing, but do it on a computer" illegal and unethical? I think it's a real important question for legislators to answer. Is it the scale? The fact that it can be automated? That we're really not actually comfortable with the meatspace example but didn't have a good way to ban it before?
Just food for thought. I'm mostly neutral on the GDPR, I appreciate the intention but I think we as a society need to define consistent expectations about privacy.
If creepy shopkeepers following you round was a thing I suspect it would be illegal already.
You could even hire someone to wander around your competing stores and take lots of notes about the people they saw. "Red shirt guy shopping around for slim fit pants". Unlikely scenario, but legal to do and to use that information.
My whole thing is - what makes the scenarios different enough that one is prohibited and one is allowed? Certainly if we told folks they must forget their observations about others upon request, that would face some baseline rebuttal about their own autonomy.
Imagine almost every store in your city installed something facial recognition (a la Amazon Go). This system, given to owners literally for free, was created by one company - Google - and allowed them to automatically see what products most people were looking at, what time they were doing so, and their demographic. As payment, Google also gets this data and is able to use it for their means.
Note: i'm just making this analogy. Google Analytics (probably) isn't being used for ad targeting.
What actually happens is that your behavior (in store or not) is permanently observed all the time and ads are served whether you want it or not.
Imagine if in all shops, always you'd get jumped on by attendant trying to sell you things. And sometimes shop attendant would appear out of the blue.
What you're describing you can have today - just convince user to make account in your shop and give you permission to send offers. You can chase him any time you want.
As opposed to the half of them where it currently happens?