You can track bounce rate and ad spend in a GDPR-compliant way. What wouldn't work is retargeting individual users via tracking pixels without their consent.