[Silhouette]

Sure, but if we're talking about data usage for marketing and targeted ads, then generally consent would be the only basis that can apply.

That's debatable. The GDPR itself explicitly notes [Recital 47] that even direct marketing can constitute a legitimate interest.

However, there are specific provisions for that case, particularly the explicit provision [Article 21, para 3] that if the data subject objects to processing for direct marketing purposes then that is black and white and that processing must be stopped.