This came up on reddit a few years ago and maybe here. There was a case that effectively determined that cdns were not gdpr compliant.

And then everyone ignored this outcome because of the implications. Ofc there is the "legitimate interests" line. Vague enough for a judge to apply as they see fit, but one judge messed up at least one time.