This would be a perfect case to really get into the nitty-gritty of joint controllership according to GDPR: Is IAB (who among other things runs the real time bidding system that is an integral part of web ads) a controller?

Also an issue the should deal with.

Sign in to participate in the conversation is the Mastodon instance for legal debate.

Run by (but not only for) legal professionals.

May the best argument win.