This would be a perfect case to really get into the nitty-gritty of joint controllership according to GDPR: Is IAB (who among other things runs the real time bidding system that is an integral part of web ads) a controller?
Also an issue the #ePrivavyR should deal with.
Legal.social is the Mastodon instance for legal debate.
Run by (but not only for) legal professionals.
May the best argument win.