I think the law is actually pretty clear on that front, that it is not ok, but in the meantime, all the big publishers do it and make so much money, they actually don't care much about fines, especially given the chance they might get levied against a competitor first, at which point they can quickly change that behaviour.

As so often, the biggest GDPR problem is missing enforcement.

The EU Data Protection Board, which unlike noyb is an official part of the EU, albeit not from the judicial branch, has also come out against pay-or-consent.