Yes, that is basically how I understand it too.

My question is what people here on HN who run free, ad supported sites do.

As far as I know, the GDPR says that not giving consent must not have negative consequences for the user. If it means they have to pay, how is that not a negative consequence?